---
id: "CVE-2026-123751"
page: "https://infrastack.ai/live/CVE-2026-123751"
kind: "vulnerability"
aliases: ["CVE-2026-123751"]
title: "WP Duplicate WordPress plugin: unauthenticated file upload leads to code execution"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "wp-duplicate", "fixed": [], "affected": "<= 1.1.11", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["runtime", "self-hosted", "wordpress", "wp-duplicate"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T07:17:30+00:00"
first_seen_at: "2026-11-09T07:25:05+00:00"
updated_at: "2026-11-09T07:26:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123751", "first_seen_at": "2026-11-09T07:25:05+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123751", "first_seen_at": "2026-11-09T07:26:25+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-123751"]}]
exploit_sources: []
---

# WP Duplicate WordPress plugin: unauthenticated file upload leads to code execution

Link for people: https://infrastack.ai/live/CVE-2026-123751 (this .md is for agents)

The WP Duplicate WordPress plugin through version 1.1.11 does not verify a request authentication value and does not validate the path or type of uploaded files. Unauthenticated attackers can write arbitrary files to the server and run code on it, and the sources say this is being actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-duplicate affected <= 1.1.11 fixed no fixed version listed

## How to check

- In WordPress admin go to Plugins and check whether WP Duplicate is installed and its version is 1.1.11 or earlier; or look for wp-content/plugins/wp-duplicate/ on the server. No fixed version is published in the sources read: until the vendor names one, deactivate and remove the plugin, and look in wp-content (especially uploads) for unexpected .php files.

## Timeline

- 2026-11-09T07:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123751
- 2026-11-09T07:26:25+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-123751 — Only NVD read (its description says exploited in the wild, no independent confirmation; not set exploited). Exa search out of credits; NVD and wordpress.org fetches returned no usable content. No vendor advisory or fixed version found; nothing verified. Needs: plugin changelog/Wordfence/WPScan entry for the fixed version. X not tried.

## Documents

- [describes] NVD CVE-2026-123751 https://nvd.nist.gov/vuln/detail/CVE-2026-123751

## From the sources

The WP Duplicate  WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_