Post Duplicator

Post Duplicator has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Missing Authorization, behind 4 of the records (40%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.

Every one of the 10 issues recorded for Post Duplicator has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, one record each. Post Duplicator is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

10

Get automatic notifications for all Post Duplicator vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-10749

Post Duplicator < 3.0.15 - Authenticated (Contributor+) PHP Object Injection

Read the full analysis

Vulnerability Records

10 records
2026-08-21 00:00CVE-2026-4244
4.3
Medium
Abi WiranataYes
2026-08-21 00:00CVE-2026-4245
4.3
Medium
Quốc Huy (jtwings)Yes
2026-06-25 00:00CVE-2026-10749
7.5
High
Md. Minaruzzaman ShovonYes
2026-04-13 00:00CVE-2026-39474
7.5
High
Nguyen Ba KhanhYes
2026-02-24 21:12CVE-2026-2301
4.3
Medium
bashuYes
2025-01-24 00:00CVE-2025-24736
4.3
Medium
Kévin Mosbahi (Mika)Yes
2025-01-10 14:15CVE-2024-12472
4.3
Medium
WebbernautYes
2023-12-05 00:00CVE-2023-49835
4.3
Medium
Huynh Tien SiYes
2021-12-02 00:00CVE-2021-33852
6.4
Medium
AnonymousYes
2016-04-06 00:00CVE-2016-15027
6.1
Medium
AnonymousYes
Showing 1–10 of 10 reports
Post Duplicator banner
Latestv3.0.16
4.8(80)
96/100
Last Updated
2026-08-22 (21d ago)
Active Installs
200,000+
Downloads
5,022,937
Requires WP
6.6+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2012-04-28 (15y ago)

Save Time. Work Smarter. Duplicate Any Post Type with Ease. Post Duplicator is the ultimate WordPress plugin for quickly creating exact duplicates of any post type in your WordPress site. Whether you’re working with standard posts, pages, or custom post types, this plugin makes it effortless to clone content while preserving all taxonomies, custom fields, and metadata. Key Features: Universal Post Type Support – Works with every post type WordPress supports, including custom post types from your favorite plugins and themes Complete Data Preservation – Automatically copies all taxonomies, custom fields, metadata, and featured images Bulk Duplication – Select and duplicate multiple posts at once with individual settings per post Multiple Clones – Create multiple copies of a single post simultaneously (up to 50 clones) Flexible Duplication Options – Customize title, slug, status, author, date, post type, and parent for each duplicate Featured Image Management – Set, replace, or remove featured images directly in the duplication modal Smart Defaults – Configure default settings that apply to all duplications (draft status, current user as author) Post Types Configuration – Control which post types can be duplicated and which appear in the “Post Type” dropdown menu Permission Control – Granular control over who can duplicate posts with role-based permissions Modern Interface – Beautiful modal interface with live editing and expandable settings Cross-Post Type Duplication – Convert posts to different post types during duplication Hierarchical Post Support – Set parent posts for pages and hierarchical custom post types One-Click Operation – Duplicate posts from the posts list, edit screen, or block editor toolbar Perfect For: Developers – Quickly generate test content and dummy data for development using bulk or multiple clone features Content Managers – Create content templates and variations efficiently with one-click duplication Bloggers – Repurpose successful posts with different angles or formats using multiple clones E-commerce – Duplicate product variations and bulk duplicate similar listings across categories Content Marketers – Create A/B testing variations with the multiple clones feature Site Migrations – Bulk duplicate posts when restructuring or migrating content Multilingual Sites – Works seamlessly with WPML and Polylang for multilingual content What Gets Duplicated: Post content and formatting Title and slug (with customizable suffixes or full editing) All custom fields and metadata Categories, tags, and custom taxonomies Featured images (with ability to change or remove) Post format and excerpt Comment and ping status Menu order Post parent (for hierarchical post types) What Doesn’t Get Duplicated: Comments (by design – prevents duplicate comment threads) Post ID and GUID (new unique identifiers assigned) How to Use: Single Duplication: Hover over any post and click “Duplicate [Post Type]” in the row actions, or click the “Duplicate Post” button in the Gutenberg editor Multiple Clones: In the duplication modal, click the copy icon to create multiple copies of a single post (up to 50 clones) Bulk Duplication: Select multiple posts using checkboxes, choose “Duplicate” from the Bulk Actions dropdown, then configure each post individually Customize Settings: Edit title, slug, status, author, date, post type, featured image, and parent for each duplicate Configure Defaults: Go to Settings > Post Duplicator to set default status, author, date, and title/slug suffixes Configure Post Types: Go to Settings > Post Duplicator > Post Types to control which post types can be duplicated and which appear in the “Post Type” dropdown menu Default Settings: The plugin works immediately with sensible defaults: * Duplicated posts are created as Drafts (prevents accidental publishing) * Title suffix: “Copy” * Slug suffix: “copy” * Author: Current User * Date: Current Time All defaults can be customized in Settings > Post Duplicator. Integration: Post Duplicator works seamlessly with: * WPML and Polylang (multilingual support) * WooCommerce (excludes review counts automatically) * ACF (Advanced Custom Fields) – preserves all field data * WP Customer Area (special file duplication support) * All custom post types and taxonomies Security: Users without publish_posts capability cannot publish duplicates (forced to Pending) Non-authors cannot duplicate unpublished posts from other users Granular permission system controls who can duplicate posts All data is sanitized and validated before duplication Developer-Friendly: Includes hooks and filters for easy customization: * mtphr_post_duplicator_created action * mtphr_post_duplicator_meta_{$key}_enabled filter * mtphr_post_duplicator_meta_value filter

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C