CVE-2026-2301: 
WordPress vulnerability analysis and mitigation

CVE-2026-2301 is a Missing Authorization vulnerability in the Post Duplicator plugin for WordPress that allows authenticated attackers with Contributor-level access or above to inject arbitrary protected post meta keys on duplicated posts. It affects all versions of the plugin up to and including 3.0.8. The vulnerability was published on February 25, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, CIRCL).

The root cause is a Missing Authorization flaw (CWE-862) in the duplicate_post() function located in includes/api.php. Rather than using WordPress's standard add_post_meta() function — which internally calls is_protected_meta() to block lower-privileged users from setting protected meta keys (those prefixed with _) — the function uses $wpdb->insert() to write directly to the wp_postmeta database table, bypassing all authorization checks. This allows an attacker to supply arbitrary key-value pairs via the customMetaData JSON array parameter in a POST request to the /wp-json/post-duplicator/v1/duplicate-post REST API endpoint, injecting sensitive meta keys such as _wp_page_template and _wp_attached_file (Feedly, CIRCL).

Successful exploitation allows an authenticated attacker with at minimum Contributor-level WordPress access to manipulate protected post metadata on duplicated posts, potentially altering page templates, file attachment references, or other sensitive internal WordPress meta keys. This primarily affects integrity — an attacker could redirect page rendering to attacker-controlled templates or manipulate how content is served, though confidentiality and availability are not directly impacted. The scope is limited to the WordPress installation where the vulnerable plugin is active (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is 0.026% (0.000260), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, CIRCL).

1. Reconnaissance: Identify WordPress sites running the Post Duplicator plugin (version ≤ 3.0.8) by checking plugin headers, readme files, or REST API discovery endpoints (e.g., /wp-json/).
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Identify a post to duplicate: Select an existing post ID on the target WordPress site that the attacker has permission to duplicate.
4. Craft malicious REST API request: Send an authenticated POST request to /wp-json/post-duplicator/v1/duplicate-post with a customMetaData JSON array containing arbitrary protected meta keys, for example:

   {
     "post_id": 123,
     "customMetaData": [
       {"key": "_wp_page_template", "value": "attacker-template.php"},
       {"key": "_wp_attached_file", "value": "malicious/path"}
     ]
   }

5. Achieve impact: The plugin writes the supplied protected meta keys directly to wp_postmeta without authorization checks, causing the duplicated post to use attacker-specified templates or file references (Feedly).

• Network: Unusual authenticated POST requests to /wp-json/post-duplicator/v1/duplicate-post from Contributor-level accounts, especially with customMetaData arrays containing keys prefixed with _.
• Logs: WordPress access logs showing REST API calls to the Post Duplicator endpoint with large or unexpected JSON payloads; repeated duplication requests from a single low-privileged user account.
• Database: Unexpected entries in the wp_postmeta table with protected meta keys (e.g., _wp_page_template, _wp_attached_file) associated with recently duplicated posts and authored by low-privileged users.
• File System: Pages rendering unexpected or unknown PHP templates that were not assigned through the standard WordPress admin interface.

WordPress site administrators should update the Post Duplicator plugin (by Metaphor Creations) to a version beyond 3.0.8 that addresses this vulnerability. As an interim workaround, restrict Contributor-level user registration or remove untrusted Contributor accounts until the plugin is patched. Additionally, consider disabling the REST API for unauthenticated or low-privileged users if the plugin's duplication functionality is not required for those roles (Feedly, CIRCL).