Post Duplicator WordPress Plugin Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in the Post Duplicator plugin for WordPress, affecting all versions through 2.36. The issue arises in the mtphr_duplicate_post() function, where inadequate restrictions allow authenticated attackers with Contributor-level access and above to duplicate posts and access data from password-protected, private, or draft posts that should be off-limits.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive post data, including information from password-protected, private, or draft posts.

Remediation

Users are advised to update the Post Duplicator plugin to version 2.37 or a newer patched version.