Language: PHP
Label: vulnerable
CWE: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Code:
	public function create_item( $request ) {
		/**
		 * Original post ID.
		 *
		 * @var int $original_id
		 */
		$original_id = ! empty( $request['original_id'] ) ? $request['original_id'] : null;
		if ( ! $original_id ) {
			return parent::create_item( $request );
		}

		$original_post = $this->get_post( $original_id );
		if ( is_wp_error( $original_post ) ) {
			return $original_post;
		}

		if ( ! $this->check_read_permission( $original_post ) ) {
			return new \WP_Error(
				'rest_cannot_create',
				__( 'Sorry, you are not allowed to duplicate this story.', 'web-stories' ),
				[ 'status' => rest_authorization_required_code() ]
			);
		}

		$request->set_param( 'content', $original_post->post_content );
		$request->set_param( 'excerpt', $original_post->post_excerpt );

		$title = sprintf(
			/* translators: %s: story title. */
			__( '%s (Copy)', 'web-stories' ),
			$original_post->post_title
		);
		$request->set_param( 'title', $title );

		$story_data = json_decode( $original_post->post_content_filtered, true );
		if ( $story_data ) {
			$request->set_param( 'story_data', $story_data );
		}

		$thumbnail_id = get_post_thumbnail_id( $original_post );
		if ( $thumbnail_id ) {
			$request->set_param( 'featured_media', $thumbnail_id );
		}

		$meta = $this->get_registered_meta( $original_post );
		if ( $meta ) {
			$request->set_param( 'meta', $meta );
		}

		return parent::create_item( $request );
	}