{"id":"CVE-2026-123751","kind":"vulnerability","aliases":["CVE-2026-123751"],"related":[],"title":"WP Duplicate WordPress plugin: unauthenticated file upload leads to code execution","description":"The WP Duplicate  WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.","summary":"The WP Duplicate WordPress plugin through version 1.1.11 does not verify a request authentication value and does not validate the path or type of uploaded files. Unauthenticated attackers can write arbitrary files to the server and run code on it, and the sources say this is being actively exploited.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-duplicate","fixed":[],"affected":"<= 1.1.11","ecosystem":"wordpress"}],"ecosystems":[],"tags":["runtime","self-hosted","wordpress","wp-duplicate"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- In WordPress admin go to Plugins and check whether WP Duplicate is installed and its version is 1.1.11 or earlier; or look for wp-content/plugins/wp-duplicate/ on the server. No fixed version is published in the sources read: until the vendor names one, deactivate and remove the plugin, and look in wp-content (especially uploads) for unexpected .php files.","fix":null,"status":"open","published_at":"2026-11-09T07:17:30+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","triaged_at":"2026-11-09T07:25:32+00:00","updated_at":"2026-11-09T07:26:25+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-09T07:25:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Duplicate WordPress plugin: unauthenticated file upload leads to code execution","impact":"high","summary":"The WP Duplicate WordPress plugin through version 1.1.11 does not verify a request authentication value and does not validate the path or type of uploaded files. Unauthenticated attackers can write arbitrary files to the server and run code on it, and the sources say this is being actively exploited.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","wp-duplicate","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker runs code on the web server","analyst_note":"Confirm the fixed version and any vendor advisory for WP Duplicate; the sources give only the affected range through 1.1.11 and no fix.","how_to_check":"- Check whether the WP Duplicate plugin is installed and its version is `1.1.11` or earlier, for example in the plugins directory of the WordPress installation\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Duplicate WordPress plugin version 1.1.11 or earlier are exposed, since the flaw is reachable without authentication. The sources do not say whether a non-default configuration is needed. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00072,"input_tokens":4551,"output_tokens":530,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory for WP Duplicate; the sources give only the affected range through 1.1.11 and no fix.","search":"'-123751':14A,17A '-2026':13A,16A '1.1.11':36B,84C 'achiev':118C 'activ':76B,126C 'arbitrari':59B,112C 'attack':56B,109C 'authent':42B,91C 'code':10A,66B,120C 'cve':12A,15A 'duplic':2A,28B,31B,80C 'duplicate':20A 'execut':11A,121C 'exploit':77B,127C 'file':6A,54B,60B,103C,113C 'host':24B 'lead':8A 'make':104C 'path':49B,98C 'plugin':4A,33B,82C 'possibl':106C 'proper':87C 'remot':119C 'request':41B,90C 'run':65B 'runtim':21B 'say':72B 'self':23B 'self-host':22B 'server':63B,116C 'sourc':71B 'type':51B,100C 'unauthent':5A,55B,108C 'upload':7A,53B,102C 'valid':47B,96C 'valu':43B,92C 'verifi':39B,88C 'version':35B 'vulner':123C 'wild':130C 'wordpress':3A,25B,32B,81C 'wp':1A,19A,27B,30B,79C 'wp-duplic':26B 'wp-duplicate':18A 'write':58B,111C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Duplicate WordPress plugin version 1.1.11 or earlier are exposed, since the flaw is reachable without authentication. The sources do not say whether a non-default configuration is needed. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["wpduplicate"],"ptokens":["duplicate","wp"],"labels":["critical","runtime","selfhosted","wordpress","wpduplicate"],"campaign_type":null,"search_a":"'-123751':14A,17A '-2026':13A,16A 'code':10A 'cve':12A,15A 'duplic':2A 'duplicate':20A 'execut':11A 'file':6A 'lead':8A 'plugin':4A 'unauthent':5A 'upload':7A 'wordpress':3A 'wp':1A,19A 'wp-duplicate':18A","search_b":"'1.1.11':36B 'activ':76B 'arbitrari':59B 'attack':56B 'authent':42B 'code':66B 'duplic':28B,31B 'exploit':77B 'file':54B,60B 'host':24B 'path':49B 'plugin':33B 'request':41B 'run':65B 'runtim':21B 'say':72B 'self':23B 'self-host':22B 'server':63B 'sourc':71B 'type':51B 'unauthent':55B 'upload':53B 'valid':47B 'valu':43B 'verifi':39B 'version':35B 'wordpress':25B,32B 'wp':27B,30B 'wp-duplic':26B 'write':58B","search_c":"'1.1.11':84C 'achiev':118C 'activ':126C 'arbitrari':112C 'attack':109C 'authent':91C 'code':120C 'duplic':80C 'execut':121C 'exploit':127C 'file':103C,113C 'make':104C 'path':98C 'plugin':82C 'possibl':106C 'proper':87C 'remot':119C 'request':90C 'server':116C 'type':100C 'unauthent':108C 'upload':102C 'valid':96C 'valu':92C 'verifi':88C 'vulner':123C 'wild':130C 'wordpress':81C 'wp':79C 'write':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123751","severity":null,"published_at":"2026-11-09T07:17:30+00:00","modified_at":"2026-11-09T07:17:30+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","fetched_at":"2026-11-09T07:25:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123751:2250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123751","severity":null,"published_at":"2026-11-09T07:26:25+00:00","modified_at":"2026-11-09T07:26:25+00:00","first_seen_at":"2026-11-09T07:26:25+00:00","fetched_at":"2026-11-09T07:26:25+00:00","note":"Only NVD read (its description says exploited in the wild, no independent confirmation; not set exploited). Exa search out of credits; NVD and wordpress.org fetches returned no usable content. No vendor advisory or fixed version found; nothing verified. Needs: plugin changelog/Wordfence/WPScan entry for the fixed version. X not tried.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123751"]}],"documents":[{"id":106361,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123751","title":"NVD CVE-2026-123751","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}