The Post Duplicator plug‑in for WordPress contains a missing capability check in its duplicate_post() function. The function accepts a selectedAuthorId parameter via the duplicate-post REST endpoint without verifying that the user holds the edit_others_posts capability, allowing an authenticated attacker to duplicate posts and attribute them to any user, including administrators. This flaw enables content spoofing and privilege escalation within the author assignment domain.

The vulnerability affects the Post Duplicator plug‑in distributed by metaphorcreations. All versions up to and including 3.0.11 are affected, regardless of other WordPress or server configurations.

The CVSS score of 4.3 indicates a low severity rating, but the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. The attack can be performed by any user with Contributor-level access or higher, so the risk is confined to authenticated users, although it allows the impersonation of administrators. The missing authorization check is the root weakness (CWE‑862).