Post Duplicator: Privilege escalation via improper option saving (CVE-2026-121874)

CVE-2026-121874 describes an improper access control vulnerability in the Post Duplicator WordPress plugin. An authenticated site administrator on a multisite WordPress network can bypass intended restrictions when saving plugin settings. By crafting requests that overwrite arbitrary options, an attacker can modify critical configurations, such as role definitions, to grant themselves administrative capabilities over the entire network.

Impact

The vulnerability allows a site-level administrator to achieve privilege escalation, gaining management capabilities equivalent to a network Super Admin.

Recommendation

Update the Post Duplicator plugin to version 3.0.18 or later to resolve the improper access control vulnerability.

Attack Chain

1. Attacker gains or holds site-administrator access within a WordPress multisite network.
2. Attacker interacts with the Post Duplicator plugin settings interface.
3. Attacker submits a settings save request modified to target options outside the plugin scope.
4. The application fails to validate the scope of the settings being updated.
5. The plugin overwrites WordPress core or network-wide settings, such as user roles.
6. Attacker leverages modified roles to gain unauthorized administrative privileges.