Unauthenticated file upload in WP Duplicate WordPress plugin
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- No fix listed
No CVSS vector from any source. Fix status from CNA.
Summary
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value. It also does not validate the path or type of uploaded files. An unauthenticated attacker can write arbitrary files to the server and achieve remote code execution. The vulnerability is being actively exploited in the wild, and a public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WP Duplicate | up to 1.1.11 | — | No fix listed | CNA |
- WP Duplicate VendorUnknown Affected up to 1.1.11 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for WP Duplicate.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Timeline
- 2026-11-09 Threatist record created from CVE-2026-123751
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences