Cpe:2.3:a:post_duplicator:post_duplicator:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apost_duplicatorpost_duplicatorwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 15:51:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPost Duplicator: Privilege escalation via role capability validation flaw (CVE-2026-121875)https://feed.craftedsignal.io/briefs/2026-11-post-duplicator-privilege-escalation/Mon, 09 Nov 2026 15:51:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-post-duplicator-privilege-escalation/The Post Duplicator WordPress plugin fails to validate role capabilities, allowing site administrators on multisite networks to elevate privileges to Super Admin status.The Post Duplicator WordPress plugin versions prior to 3.0.18 contain a vulnerability where role capabilities are not properly validated within the permissions settings. This flaw allows a standard site administrator in a multisite WordPress environment to assign administrative or network-management capabilities to arbitrary roles. This effectively enables privilege escalation to the Super Admin level, bypassing intended security boundaries.

Impact

Successful exploitation allows a low-privileged site administrator to gain unauthorized administrative control over the entire WordPress multisite network, including the ability to manage network settings, install plugins, and modify user access.

Recommendation

  • Update the Post Duplicator plugin to version 3.0.18 or later immediately to address the missing capability validation.
  • Audit existing role assignments in WordPress multisite networks for unexpected modifications, specifically checking for roles granted administrative permissions that should not have them.
  • Review administrative logs for changes to role capabilities performed by non-Super Admin users.
]]>highadvisory