Skip to content
PluginCanary

Post Duplicator

by metaphorcreations · 200,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 4 Nov 2026, 31 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for Post Duplicator
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is Post Duplicator still maintained?
Yes. Last release 4 Nov 2026, 31 releases in the last 24 months. 4 Nov 2026 · wordpress.org
Who owns Post Duplicator, and has it changed hands?
No change recorded. Main committer metaphorcreations since Apr 2012. 4 Nov 2026 · SVN log
Was Post Duplicator removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Post Duplicator safe?
10 known vulnerabilities, all fixed (latest in 3.0.12). Not on the exploited list. 21 Aug 2026 · Wordfence Intelligence
Is the latest Post Duplicator update safe to install?
No ownership change before 3.0.18. No one-star spike after it. 4 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
metaphorcreations28 Apr 2012 to 4 Nov 2026, 130 commits

1 committer recorded. No ownership change since 2012.

Maintenance

Last release
today
Releases, 24 months
31
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Post Duplicator
Q1 20241
Q2 20242
Q3 20241
Q4 20240
Q1 20259
Q2 20252
Q3 20250
Q4 20256
Q1 20269
Q2 20262
Q3 20261
Q4 20262

Last release 4 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Average rating per quarter for Post Duplicator
Q1 20245.0
Q3 20245.0
Q1 20255.0
Q2 20255.0
Q4 20255.0
Q1 20265.0
Q2 20265.0

Average rating stayed at 5.0 between Q1 2024 and Q2 2026.

Rating distribution
5 star72
4 star3
3 star2
2 star0
1 star3
Latest low reviews

Security record

7 vulnerabilities in 24 months (10 on record), all patched (latest fixed in 3.0.12).

Show 10 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
21 Aug 2026Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution4.3<= 3.0.113.0.12Patched before disclosure
21 Aug 2026Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication4.3<= 3.0.113.0.12Patched before disclosure
25 Jun 2026Post Duplicator < 3.0.15 - Authenticated (Contributor+) PHP Object Injection7.5< 3.0.153.0.15Patched before disclosure
13 Apr 2026Post Duplicator <= 3.0.10 - Authenticated (Contributor+) PHP Object Injection7.5<= 3.0.103.0.11Patched before disclosure
24 Feb 2026Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter4.3<= 3.0.83.0.9Patched before disclosure
24 Jan 2025Post Duplicator <= 2.35 - Missing Authorization4.3<= 2.352.36Patched before disclosure
10 Jan 2025Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure4.3<= 2.362.37Patched before disclosure
5 Dec 2023Post Duplicator <= 2.31 - Missing Authorization via mtphr_duplicate_post4.3<= 2.312.32Patched before disclosure
2 Dec 2021Post Duplicator <= 2.23 - Cross-Site Scripting6.4< 2.242.2428
6 Apr 2016Post Duplicator <= 2.16 - Reflected Cross-Site Scripting6.1<= 2.162.17n/a

Changelog mentions of security fixes: 3.0.15 (security); 3.0.18 (security); 3.0.17 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

200,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Post Duplicator
4 May 20263,516
11 May 202661,876
18 May 202629,835
25 May 202612,441
1 Jun 202610,168
8 Jun 20267,976
15 Jun 20266,878
22 Jun 20268,046
29 Jun 20267,838
6 Jul 20265,603
13 Jul 20265,242
20 Jul 20266,436
27 Jul 20265,898
3 Aug 20265,879
10 Aug 20264,982
17 Aug 202651,738
24 Aug 202627,025
31 Aug 202615,237
7 Sep 202610,803
14 Sep 202615,927
21 Sep 202611,712
28 Sep 20268,169
5 Oct 20267,580
12 Oct 20266,568
19 Oct 20269,346
26 Oct 202663,731
2 Nov 20265,611

Weekly downloads over the last 4 weeks are 38% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Duplicate PPScore 96 · 10,000+Duplicate Page and PostScore 93 · 70,000+Yoast Duplicate PostScore 92 · 3,000,000+Duplicate PostScore 91 · 300,000+WP Post Page CloneScore 90 · 70,000+

Facts

Version3.0.18
Authormetaphorcreations
Added28 Apr 2012
Last updated4 Nov 2026
Active installs200,000+
Requires WordPress6.6
Tested up to7.1.4
Requires PHP7.4
CategorySite Administration & Utilities > Site Migration & Cloning
Tagspost, posts, duplicate, duplication

Other plugins by this author: Ditty - Responsive News Tickers, Sliders, and Lists

Questions

Is Post Duplicator still maintained?

Yes. Last release 4 Nov 2026, 31 releases in the last 24 months.

Who owns Post Duplicator, and has it changed hands?

No change recorded. Main committer metaphorcreations since Apr 2012.

Was Post Duplicator removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Post Duplicator safe?

10 known vulnerabilities, all fixed (latest in 3.0.12). Not on the exploited list.

Is the latest Post Duplicator update safe to install?

No ownership change before 3.0.18. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue