WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass authentication checks and write arbitrary files to the server via the `handle_upload_single_big_file()` function, ultimately leading to remote code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1499
- 2026-10-03 Alias added: GHSA-r262-f4qm-hrp9
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/11bb7190-023b-45e1-99a5-7313c489ef45?source=cve
- https://plugins.trac.wordpress.org/browser/local-sync/trunk/admin/class-local-sync-admin.php#L422
- https://plugins.trac.wordpress.org/browser/local-sync/tags/1.1.8/admin/class-local-sync-admin.php#L422
- https://plugins.trac.wordpress.org/browser/local-sync/trunk/includes/class-local-sync-handle-server-requests.php#L389
- https://plugins.trac.wordpress.org/browser/local-sync/tags/1.1.8/includes/class-local-sync-handle-server-requests.php#L389
- https://plugins.trac.wordpress.org/browser/local-sync/trunk/admin/class-local-sync-files-op.php#L843
- https://plugins.trac.wordpress.org/browser/local-sync/tags/1.1.8/admin/class-local-sync-files-op.php#L843
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3452904%40local-sync&old=3400317%40local-sync&sfp_email=&sfph_mail=
More revmakx vulnerabilities
- TI-2024-08222 Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2020-07033 The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization… CVSS 3.1CRITICAL 9.8
- TI-2016-09124 InfiniteWP Client Plugin injection CVSS 3.1CRITICAL 9.8
- TI-2023-02734 InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure CVSS 3.1HIGH 7.5
- TI-2024-26004 Improper privilege management in revmakx Backup and Staging by WP Time Capsule CVSS 3.1CRITICAL 9.8
- TI-2026-67954 Arbitrary file upload in WordPress WP Duplicate plugin CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-1499 · CVE Program
- CVE-2026-1499 · NVD
- FIRST EPSS
- GHSA-r262-f4qm-hrp9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences