{"id":"CVE-2026-121874","kind":"vulnerability","aliases":["CVE-2026-121874"],"related":[],"title":"Post Duplicator WordPress plugin lets multisite admins overwrite site options","description":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.","summary":"The Post Duplicator WordPress plugin before 3.0.18 saves settings without limiting them to its own options. A site administrator on a WordPress multisite network who is not a Super Admin can overwrite any option on their site, including role definitions, and grant themselves network-management capabilities.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","post-duplicator","wordpress"],"not_affected_if":["plugin-not-installed","single-site-wordpress","version-3.0.18-or-later"],"how_to_check":"- Check the installed Post Duplicator version in the plugins list or the plugin's main file header.\n- Confirm whether the site runs WordPress multisite.","fix":"- Post Duplicator: `3.0.18` or later (the version the description says the flaw was fixed in).","status":"open","published_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:44+00:00","updated_at":"2026-11-09T07:25:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T07:25:44Z","model":"claude-haiku-5-5","output":{"fix":"- Post Duplicator: `3.0.18` or later (the version the description says the flaw was fixed in).","reach":"network","title":"Post Duplicator WordPress plugin lets multisite admins overwrite site options","impact":"high","summary":"The Post Duplicator WordPress plugin before 3.0.18 saves settings without limiting them to its own options. A site administrator on a WordPress multisite network who is not a Super Admin can overwrite any option on their site, including role definitions, and grant themselves network-management capabilities.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","multisite","post-duplicator"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Site admin gains network-management capabilities across the multisite network","analyst_note":"","how_to_check":"- Check the installed Post Duplicator version in the plugins list or the plugin's main file header.\n- Confirm whether the site runs WordPress multisite.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-site-wordpress","plugin-not-installed","version-3.0.18-or-later"],"who_is_affected":"Only WordPress multisite networks running Post Duplicator before 3.0.18 are exposed, and only through site administrators who are not Super Admins. Single-site WordPress installs are not described as affected. Sites that do not run the plugin can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4547,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121874':13A,16A '-2026':12A,15A '3.0.18':29B,76C 'admin':7A,52B,99C 'administr':41B,89C 'allow':86C 'arbitrari':102C 'capabl':69B,118C 'cve':11A,14A 'definit':62B,110C 'duplic':2A,21B,25B,72C 'grant':64B,113C 'includ':60B,107C 'let':5A 'limit':33B 'manag':68B,117C 'multisit':6A,17B,45B,92C 'network':46B,67B,93C,116C 'network-manag':66B,115C 'option':10A,38B,56B,85C,103C 'overwrit':8A,54B,101C 'packag':18B 'plugin':4A,27B,74C 'post':1A,20B,24B,71C 'post-dupl':19B 'restrict':79C 'role':61B,109C 'save':30B,81C 'set':31B,80C 'site':9A,40B,59B,88C,106C 'super':51B,98C 'without':32B 'wordpress':3A,22B,26B,44B,73C","nicknames":[],"mitigations":[],"who_affected":"Only WordPress multisite networks running Post Duplicator before 3.0.18 are exposed, and only through site administrators who are not Super Admins. Single-site WordPress installs are not described as affected. Sites that do not run the plugin can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","multisite","package","postduplicator","wordpress"],"campaign_type":null,"search_a":"'-121874':13A,16A '-2026':12A,15A 'admin':7A 'cve':11A,14A 'duplic':2A 'let':5A 'multisit':6A 'option':10A 'overwrit':8A 'plugin':4A 'post':1A 'site':9A 'wordpress':3A","search_b":"'3.0.18':29B 'admin':52B 'administr':41B 'capabl':69B 'definit':62B 'duplic':21B,25B 'grant':64B 'includ':60B 'limit':33B 'manag':68B 'multisit':17B,45B 'network':46B,67B 'network-manag':66B 'option':38B,56B 'overwrit':54B 'packag':18B 'plugin':27B 'post':20B,24B 'post-dupl':19B 'role':61B 'save':30B 'set':31B 'site':40B,59B 'super':51B 'without':32B 'wordpress':22B,26B,44B","search_c":"'3.0.18':76C 'admin':99C 'administr':89C 'allow':86C 'arbitrari':102C 'capabl':118C 'definit':110C 'duplic':72C 'grant':113C 'includ':107C 'manag':117C 'multisit':92C 'network':93C,116C 'network-manag':115C 'option':85C,103C 'overwrit':101C 'plugin':74C 'post':71C 'restrict':79C 'role':109C 'save':81C 'set':80C 'site':88C,106C 'super':98C 'wordpress':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121874","severity":null,"published_at":"2026-11-09T07:17:28+00:00","modified_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}