{
 "id": "WPSEC-2026-2065",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2065/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2065/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2065/index.md",
 "title": "Post Duplicator <= 3.0.16 - Authenticated (Contributor+) Sensitive Information Exposure via Users REST Route",
 "description": "The Post Duplicator plugin for WordPress is vulnerable to Sensitive Information Exposure via the users REST route in all versions from 3.0.6 up to, and including, 3.0.16, due to the route returning every user with the edit_posts capability to any caller with edit_posts, without checking for the edit_others_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain the user IDs, display names and login usernames of all Contributor-level and higher users, including administrators.",
 "plugin": {
  "slug": "post-duplicator",
  "name": "Post Duplicator",
  "full_name": "Post Duplicator",
  "wordpress_org": "https://wordpress.org/plugins/post-duplicator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/post-duplicator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/post-duplicator"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.6",
    "from_inclusive": true,
    "to": "3.0.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.6 before 3.0.17"
  ]
 },
 "introduced_in": "3.0.6",
 "fixed_in": "3.0.17",
 "remediation": "Update to 3.0.17 or later.",
 "fix_released": "2026-10-29T13:03:35+00:00",
 "published": "2026-10-30T13:53:52+00:00",
 "updated": "2026-10-29T17:43:58.457134+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2065/",
  "https://plugins.svn.wordpress.org/post-duplicator/tags/3.0.17/",
  "https://wordpress.org/plugins/post-duplicator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-duplicator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}