The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the duplicate_post() function in includes/api.php using $wpdb->insert() directly to the wp_postmeta table instead of WordPress's standard add_post_meta() function, which would call is_protected_meta() to prevent lower-privileged users from setting protected meta keys (those starting with _). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as _wp_page_template, _wp_attached_file, and other sensitive meta keys on duplicated posts via the customMetaData JSON array parameter in the /wp-json/post-duplicator/v1/duplicate-post REST API endpoint.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-2301
• https://plugins.trac.wordpress.org/browser/post-duplicator/tags/3.0.6/includes/api.php#L843
• https://plugins.trac.wordpress.org/browser/post-duplicator/tags/3.0.6/includes/api.php#L923
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3463768%40post-duplicator%2Ftrunk&old=3459096%40post-duplicator%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c86f72-934c-4f3b-ab2a-65df1490ca8a?source=cve