# Post Duplicator <= 3.0.16 - Authenticated (Contributor+) Sensitive Information Exposure via Users REST Route

- **ID:** WPSEC-2026-2065
- **Plugin:** Post Duplicator (`post-duplicator`), https://wordpress.org/plugins/post-duplicator/
- **Affected versions:** from 3.0.6 before 3.0.17
- **Fixed in:** 3.0.17 (Update to 3.0.17 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/post-duplicator
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2065/

## Description

The Post Duplicator plugin for WordPress is vulnerable to Sensitive Information Exposure via the users REST route in all versions from 3.0.6 up to, and including, 3.0.16, due to the route returning every user with the edit_posts capability to any caller with edit_posts, without checking for the edit_others_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain the user IDs, display names and login usernames of all Contributor-level and higher users, including administrators.

## References

- https://wpsec.com/vuln/WPSEC-2026-2065/
- https://plugins.svn.wordpress.org/post-duplicator/tags/3.0.17/
- https://wordpress.org/plugins/post-duplicator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2065/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.