Skip to content
Threat Feed
Subscribe
high advisory

WP Duplicate: Unauthenticated arbitrary file upload (CVE-2026-123751)

An unauthenticated arbitrary file upload vulnerability in the WP Duplicate WordPress plugin allows remote attackers to achieve remote code execution via file upload.

CVE search metadata

CVE search record: CVE-2026-123751. KEV: no. Product: WP Duplicate (<= 1.1.11). Brief: WP Duplicate: Unauthenticated arbitrary file upload (CVE-2026-123751). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123751/

Triage facts

Revision 1
Applicability
WP Duplicate (<= 1.1.11)
Evidence
Unknown
Severity
High
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Nov 9, 09:25 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Very likely

The WP Duplicate WordPress plugin (versions 1.1.11 and earlier) contains an unauthenticated arbitrary file upload vulnerability (CVE-2026-123751). The plugin fails to verify request authentication and does not validate the type or path of uploaded files, allowing remote attackers to upload arbitrary code to the server. Active exploitation of this vulnerability has been observed.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the web server hosting the WordPress site, leading to full site compromise.

Recommendation

  • Immediately update the WP Duplicate plugin to a version beyond 1.1.11 if a patch is available.
  • If a patch is not immediately available, disable or remove the WP Duplicate plugin from the WordPress environment until an update is applied.
  • Audit the WordPress web root and media directories for unauthorized executable files (e.g., .php, .php5, .phtml) uploaded by unknown users.

Immediate actions

Identify all WordPress instances running the WP Duplicate plugin

IT Operations 24h

Check web access logs for 200 OK responses to POST requests directed at the WP Duplicate plugin directory

SOC 24h

Mitigations

Disable the WP Duplicate plugin or update to a patched version if available

immediate IT Operations

CVE-2026-123751

Detection coverage 1

Detect CVE-2026-123751 Exploitation - Arbitrary File Upload

high

Detects potential exploitation of CVE-2026-123751 by identifying suspicious file upload attempts to the WP Duplicate plugin directory.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →