Remote Code Execution Vulnerability in Post Duplicator WordPress Plugin
CVE-2026-121874
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-121874?
The Post Duplicator plugin for WordPress, prior to version 3.0.18, is susceptible to a vulnerability that enables non-Super Admin site administrators within a multisite environment to modify arbitrary site options. This oversight may allow unauthorized users to alter critical settings, including role definitions, thus potentially granting themselves elevated network management privileges. It is crucial for administrators to update the plugin to mitigate these risks and safeguard their networks.
Affected Version(s)
Post Duplicator 0 < 3.0.18
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.