Post Duplicator

Post Duplicator through 3.0.11 does not require edit_others_posts in duplicate_post(). A Contributor can supply selectedAuthorId to the duplicate-post REST endpoint and create a duplicated post attributed to any account, including an Administrator. Confirmed fixed release: 3.0.12.

A Contributor or higher can pass duplicate_post_permissions() with duplicate_posts but without publish_posts or status-specific authorization. They can create future or private duplicate posts, bypassing editorial review, and duplicate post types disabled by an administrator. The REST route and status parameter name are unspecified. Affected versions: <= 3.0.11. Confirmed fixed release: 3.0.12.

Post Duplicator is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 3.0.15.

Post Duplicator is affected by code execution. Exploitation requires an authenticated contributor account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 3.0.10.

Post Duplicator is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Post Duplicator is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Post Duplicator is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Post Duplicator is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Post Duplicator is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Post Duplicator is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.