Read the docs
TI-2026-86994 Aliases CVE-2026-121875

Privilege escalation in Post Duplicator WordPress plugin via role capabilities

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings. A site administrator on a multisite network who is not a Super Admin can grant any role arbitrary capabilities, including network-management capabilities reserved to the Super Admin. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Description from the CNA

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.

Why it matters now

Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Post Duplicator (Unknown): 3.0.18

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownPost Duplicatorbefore 3.0.183.0.18Patch availableCNA
  • Post Duplicator VendorUnknown Affected before 3.0.18 Fixed in 3.0.18 Patch available CNA

Remediation

Update Post Duplicator to version 3.0.18 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

  • Fix · CNA Post Duplicator (Unknown) Fixed in 3.0.18

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Post Duplicator 3.0.18

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-86993 Arbitrary option overwrite in Post Duplicator WordPress pluginPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-11-09 Threatist record created from CVE-2026-121875

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences