{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/post-duplicator--3.0.18/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:post_duplicator:post_duplicator:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-121875"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Post Duplicator (\u003c 3.0.18)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Post Duplicator WordPress plugin versions prior to 3.0.18 contain a vulnerability where role capabilities are not properly validated within the permissions settings. This flaw allows a standard site administrator in a multisite WordPress environment to assign administrative or network-management capabilities to arbitrary roles. This effectively enables privilege escalation to the Super Admin level, bypassing intended security boundaries.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged site administrator to gain unauthorized administrative control over the entire WordPress multisite network, including the ability to manage network settings, install plugins, and modify user access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Post Duplicator plugin to version 3.0.18 or later immediately to address the missing capability validation.\u003c/li\u003e\n\u003cli\u003eAudit existing role assignments in WordPress multisite networks for unexpected modifications, specifically checking for roles granted administrative permissions that should not have them.\u003c/li\u003e\n\u003cli\u003eReview administrative logs for changes to role capabilities performed by non-Super Admin users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:51:34Z","date_published":"2026-11-09T15:51:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-post-duplicator-privilege-escalation/","summary":"The Post Duplicator WordPress plugin fails to validate role capabilities, allowing site administrators on multisite networks to elevate privileges to Super Admin status.","title":"Post Duplicator: Privilege escalation via role capability validation flaw (CVE-2026-121875)","url":"https://feed.craftedsignal.io/briefs/2026-11-post-duplicator-privilege-escalation/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-121874"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Post Duplicator (\u003c 3.0.18)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","privilege-escalation","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-121874 describes an improper access control vulnerability in the Post Duplicator WordPress plugin. An authenticated site administrator on a multisite WordPress network can bypass intended restrictions when saving plugin settings. By crafting requests that overwrite arbitrary options, an attacker can modify critical configurations, such as role definitions, to grant themselves administrative capabilities over the entire network.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows a site-level administrator to achieve privilege escalation, gaining management capabilities equivalent to a network Super Admin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Post Duplicator plugin to version 3.0.18 or later to resolve the improper access control vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains or holds site-administrator access within a WordPress multisite network.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the Post Duplicator plugin settings interface.\u003c/li\u003e\n\u003cli\u003eAttacker submits a settings save request modified to target options outside the plugin scope.\u003c/li\u003e\n\u003cli\u003eThe application fails to validate the scope of the settings being updated.\u003c/li\u003e\n\u003cli\u003eThe plugin overwrites WordPress core or network-wide settings, such as user roles.\u003c/li\u003e\n\u003cli\u003eAttacker leverages modified roles to gain unauthorized administrative privileges.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-09T15:51:29Z","date_published":"2026-11-09T15:51:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-post-duplicator-wordpress-vulnerability/","summary":"The Post Duplicator WordPress plugin versions prior to 3.0.18 contain an access control flaw allowing site administrators in multisite environments to overwrite arbitrary site options and escalate privileges.","title":"Post Duplicator: Privilege escalation via improper option saving (CVE-2026-121874)","url":"https://feed.craftedsignal.io/briefs/2026-11-post-duplicator-wordpress-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Post Duplicator (\u003c 3.0.18)","version":"https://jsonfeed.org/version/1.1"}