CVE-2026-121874
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Post Duplicator WordPress plugin before version 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
Risk Assessment
A site administrator can escalate their privileges to Super Admin level, compromising the security of the entire multisite network and potentially taking control of other sites.
Recommendation
Update the Post Duplicator plugin to version 3.0.18 or later to restrict settings saves to its own options only.
Other vulnerabilities in Post Duplicator WordPress plugin
See all- CVE-2026-121875High
The Post Duplicator WordPress plugin before version 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.
- CVE-2026-111740Low
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type. This allows users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
- CVE-2026-10749High
The Post Duplicator WordPress plugin before version 3.0.15 does not safely handle custom meta-data during post duplication, allowing attacker-supplied serialized values to be stored without the WordPress meta API's double-serialization protection.
Original NVD description (English source)
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS