Arbitrary Protected Post Meta Insertion Vulnerability in Post Duplicator Plugin for WordPress

CVE-2026-2301

What is CVE-2026-2301?

The Post Duplicator plugin for WordPress has a vulnerability allowing users with Contributor-level access or higher to insert arbitrary protected post meta information into duplicated posts. The issue arises from the duplicate_post() function's direct use of the $wpdb->insert() method on the wp_postmeta table, bypassing WordPress's appropriate add_post_meta() function that should enforce checks via is_protected_meta(). As a result, authenticated attackers can manipulate sensitive meta keys such as _wp_page_template and _wp_attached_file through the customMetaData parameter in the plugin's REST API endpoint, posing a significant risk to site security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References