Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CVE-2026-123751: WP Duplicate lets attackers upload files and run code
CVE-2026-123751 · published today
Summary
The WP Duplicate WordPress plugin up through version 1.1.11 does not check who is uploading files or what kind of files are being uploaded. As a result, anyone on the Internet can place malicious files on your site and take control of the server, and attackers are already using this. Update the plugin to a newer, fixed version or remove it entirely if you do not need it.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wp duplicate | <= 1.1.11 |
Original advisory text
WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
References
- https://wpscan.com/vulnerability/3a3556f0-fc36-4f68-b826-406a7b4c3f9e/ exploit vdb-entry technical-description
Type
CWE-434Unrestricted File Upload
Timeline
Published9 Nov 2026
Updated9 Nov 2026
First seen9 Nov 2026
Track software like this
Free during beta