{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wp-duplicate--1.1.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-123751"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP Duplicate (\u003c= 1.1.11)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","rce","file-upload"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe WP Duplicate WordPress plugin (versions 1.1.11 and earlier) contains an unauthenticated arbitrary file upload vulnerability (CVE-2026-123751). The plugin fails to verify request authentication and does not validate the type or path of uploaded files, allowing remote attackers to upload arbitrary code to the server. Active exploitation of this vulnerability has been observed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to execute arbitrary code on the web server hosting the WordPress site, leading to full site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the WP Duplicate plugin to a version beyond 1.1.11 if a patch is available.\u003c/li\u003e\n\u003cli\u003eIf a patch is not immediately available, disable or remove the WP Duplicate plugin from the WordPress environment until an update is applied.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress web root and media directories for unauthorized executable files (e.g., .php, .php5, .phtml) uploaded by unknown users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T09:25:18Z","date_published":"2026-11-09T09:25:18Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123751/","summary":"An unauthenticated arbitrary file upload vulnerability in the WP Duplicate WordPress plugin allows remote attackers to achieve remote code execution via file upload.","title":"WP Duplicate: Unauthenticated arbitrary file upload (CVE-2026-123751)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123751/"}],"language":"en","title":"CraftedSignal Threat Feed - WP Duplicate (\u003c= 1.1.11)","version":"https://jsonfeed.org/version/1.1"}