The Post Duplicator plugin for WordPress allows authenticated contributors and higher to duplicate posts with future or private status by relying on a permission callback that only checks the duplicate_posts capability. This permits attackers to create content that bypasses editorial review, potentially leading to undesired scheduling or publishing of private posts. Additionally, the exposed REST endpoint ignores administrator‑set restrictions on which post types may be duplicated, so contributors can duplicate post types that have been explicitly disabled. The weakness is an improper authorization control (CWE‑863) that can introduce data confidentiality and integrity issues.

WordPress sites running Metaphor Creations Post Duplicator plugin versions up to and including 3.0.11 are affected. Newer releases beyond 3.0.11 are not vulnerable. The plugin functions within the standard WordPress environment and its REST API.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score is not available, but the lack of KEV listing suggests that exploitation is not yet confirmed in the wild. The likely attack vector is via the REST endpoint or standard duplicate post UI accessed by an authenticated user with Contributor or higher capability, which is common on many WordPress installations. An attacker who can authenticate will be able to create scheduled or private posts and duplicate undesired post types without approval.