WP-DUPLICATE · CVE-2026-123751 · Runtime
NO FIX YET
The WP Duplicate WordPress plugin through version 1.1.11 does not verify a request authentication value and does not validate the path or type of uploaded files. Unauthenticated attackers can write arbitrary files to the server and run code on it, and the sources say this is being actively exploited.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the WP Duplicate WordPress plugin version 1.1.11 or earlier are exposed, since the flaw is reachable without authentication. The sources do not say whether a non-default configuration is needed. unknown
Not affected if plugin-not-installed
Who cares self-hosted, wordpress, wp-duplicate
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.