Impact

Successful exploitation allows a low-privileged site administrator to gain unauthorized administrative control over the entire WordPress multisite network, including the ability to manage network settings, install plugins, and modify user access.

Recommendation

• Update the Post Duplicator plugin to version 3.0.18 or later immediately to address the missing capability validation.
• Audit existing role assignments in WordPress multisite networks for unexpected modifications, specifically checking for roles granted administrative permissions that should not have them.
• Review administrative logs for changes to role capabilities performed by non-Super Admin users.

Impact

The vulnerability allows a site-level administrator to achieve privilege escalation, gaining management capabilities equivalent to a network Super Admin.

Recommendation

Update the Post Duplicator plugin to version 3.0.18 or later to resolve the improper access control vulnerability.

Attack Chain

1. Attacker gains or holds site-administrator access within a WordPress multisite network.
2. Attacker interacts with the Post Duplicator plugin settings interface.
3. Attacker submits a settings save request modified to target options outside the plugin scope.
4. The application fails to validate the scope of the settings being updated.
5. The plugin overwrites WordPress core or network-wide settings, such as user roles.
6. Attacker leverages modified roles to gain unauthorized administrative privileges.