CVE-2026-121875 · Package
NO FIX YET · SEE WHAT TO DO
The Post Duplicator WordPress plugin before 3.0.18 does not validate role capabilities set in its permissions settings. A non-Super Admin on a WordPress multisite network can grant any role arbitrary capabilities, including network-management ones reserved for Super Admin.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only WordPress multisite networks running Post Duplicator before 3.0.18 are described as exposed. The attacker must already be a site administrator on a subsite who is not a Super Admin. Single-site WordPress installs are not described as affected by the sources.
Not affected if no-multisite, plugin-version-3.0.18-or-later, single-site-wordpress
Who cares multisite, wordpress, wordpress-plugins
wp plugin get post-duplicator --field=version (unknown if the exact plugin slug differs)3.0.18 (the plugin is fixed in versions from 3.0.18, per the advisory description)The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.