CVE-2026-121875
Received Received - Intake

Unauthorized Capability Escalation in Post Duplicator WordPress Plugin

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: WPScan

Description
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-121875
EUVD
EUVD-2026-119827

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Post Duplicator From 0 (inc) to 3.0.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Post Duplicator WordPress plugin before version 3.0.18 has a flaw where it does not check if roles are allowed to assign certain capabilities. This lets a site administrator on a multisite network who is not a Super Admin grant any role extra permissions, including those meant only for Super Admins.

Detection Guidance

Check the installed version of the Post Duplicator plugin. If it is below 3.0.18, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep post-duplicator in WP-CLI.

Impact Analysis

An attacker with site administrator access could escalate their privileges to gain control over the entire multisite network. This could allow them to manage other sites, install plugins, or delete content without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR or HIPAA. Unauthorized privilege escalation may result in improper data handling or exposure, triggering legal and regulatory penalties.

Mitigation Strategies

Update the Post Duplicator plugin to version 3.0.18 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...