File Upload Vulnerability in WP Duplicate Plugin for WordPress
CVE-2026-123751
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 November 2026
Badges
What is CVE-2026-123751?
The WP Duplicate plugin for WordPress, specifically versions up to 1.1.11, is susceptible to a significant security flaw where it fails to adequately verify request authentication values and does not properly validate the type or path of uploaded files. This oversight allows unauthenticated attackers to write arbitrary files on the server, potentially leading to remote code execution. Given the active exploitation of this vulnerability in the wild, it is critical for users to ensure their plugins are updated and to implement additional security measures to mitigate risks.
Affected Version(s)
WP Duplicate 0 <= 1.1.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.