Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?DuplicatorWordPress Backup & MigrationPost DuplicatorFastDup – Fastest WordPress Migration & DuplicatorEasy Post DuplicatorTheme File DuplicatorWP Quick Post DuplicatorMultiSite Clone Duplicator
Plugin · post-duplicator
Post Duplicator
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 22, 2026Post Duplicator: Unauthorized modification of dataCVE-2026-4244 · affects up to 3.0.11 · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has `edit_others_posts` capability before accepting a `selectedAuthorId` parameter via the `duplicate-post` REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Post Duplicator: Authorization bypassCVE-2026-4245 · affects up to 3.0.11 · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 24, 2026Post Duplicator: Does not safely handle custom meta-data during post duplicationCVE-2026-10749 · fixed in 3.0.15 · reported by WPScanHigh 7.2
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.
Jun 15, 2026Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.CVE-2026-39474 · affects up to 3.0.10 · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.
Feb 25, 2026Post Duplicator: Unauthorized arbitrary protected post meta insertionCVE-2026-2301 · affects up to 3.0.8 · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the `duplicate_post()` function in `includes/api.php` using `$wpdb->insert()` directly to the `wp_postmeta` table instead of WordPress's standard `add_post_meta()` function, which would call `is_protected_meta()` to prevent lower-privileged users from setting protected meta keys (those starting with `_`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as `_wp_page_template`, `_wp_attached_file`, and other sensitive meta keys on duplicated posts via the `customMetaData` JSON array parameter in the `/wp-json/post-duplicator/v1/duplicate-post` REST API endpoint.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 24, 2025Post Duplicator: Missing AuthorizationCVE-2025-24736 · affects up to 2.35 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through <= 2.35.
Jan 10, 2025Post Duplicator: Information ExposureCVE-2024-12472 · affects up to 2.36 · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.
Dec 9, 2024Post Duplicator: Missing AuthorizationCVE-2023-49835 · affects up to 2.31 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.