Vulnerabilities / Post Duplicator / WPSEC-2026-2065
Post Duplicator <= 3.0.16 - Authenticated (Contributor+) Sensitive Information Exposure via Users REST Route
Medium 4.3
CWE-200Fixed in 3.0.17
- ID
- WPSEC-2026-2065
- Plugin
- Post Duplicator (post-duplicator)
- Affected
- from 3.0.6 before 3.0.17
- Remediation
- Update to 3.0.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- Post Duplicator on WPSec AttackSurface
- Fix released
- Published
Description
The Post Duplicator plugin for WordPress is vulnerable to Sensitive Information Exposure via the users REST route in all versions from 3.0.6 up to, and including, 3.0.16, due to the route returning every user with the edit_posts capability to any caller with edit_posts, without checking for the edit_others_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain the user IDs, display names and login usernames of all Contributor-level and higher users, including administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-2065/
- https://plugins.svn.wordpress.org/post-duplicator/tags/3.0.17/
- https://wordpress.org/plugins/post-duplicator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS