Read the docs
TI-2026-86993 Aliases CVE-2026-121874

Arbitrary option overwrite in Post Duplicator WordPress plugin

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options. A site administrator on a multisite network who is not a Super Admin can overwrite arbitrary options of their site, including role definitions, and so grant themselves network-management capabilities. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Description from the CNA

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.

Why it matters now

Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Post Duplicator (Unknown): 3.0.18

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownPost Duplicatorbefore 3.0.183.0.18Patch availableCNA
  • Post Duplicator VendorUnknown Affected before 3.0.18 Fixed in 3.0.18 Patch available CNA

Remediation

Update Post Duplicator to version 3.0.18 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

  • Fix · CNA Post Duplicator (Unknown) Fixed in 3.0.18

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Post Duplicator 3.0.18

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-86994 Privilege escalation in Post Duplicator WordPress plugin via role capabilitiesPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-11-09 Threatist record created from CVE-2026-121874

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences