Post Duplicator: Privilege escalation via role capability validation flaw (CVE-2026-121875)

The Post Duplicator WordPress plugin versions prior to 3.0.18 contain a vulnerability where role capabilities are not properly validated within the permissions settings. This flaw allows a standard site administrator in a multisite WordPress environment to assign administrative or network-management capabilities to arbitrary roles. This effectively enables privilege escalation to the Super Admin level, bypassing intended security boundaries.

Impact

Successful exploitation allows a low-privileged site administrator to gain unauthorized administrative control over the entire WordPress multisite network, including the ability to manage network settings, install plugins, and modify user access.

Recommendation

• Update the Post Duplicator plugin to version 3.0.18 or later immediately to address the missing capability validation.
• Audit existing role assignments in WordPress multisite networks for unexpected modifications, specifically checking for roles granted administrative permissions that should not have them.
• Review administrative logs for changes to role capabilities performed by non-Super Admin users.