WP Duplicate (<= 1.1.11) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-duplicate--1.1.11/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 09:25:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWP Duplicate: Unauthenticated arbitrary file upload (CVE-2026-123751)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123751/Mon, 09 Nov 2026 09:25:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-123751/An unauthenticated arbitrary file upload vulnerability in the WP Duplicate WordPress plugin allows remote attackers to achieve remote code execution via file upload.The WP Duplicate WordPress plugin (versions 1.1.11 and earlier) contains an unauthenticated arbitrary file upload vulnerability (CVE-2026-123751). The plugin fails to verify request authentication and does not validate the type or path of uploaded files, allowing remote attackers to upload arbitrary code to the server. Active exploitation of this vulnerability has been observed.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the web server hosting the WordPress site, leading to full site compromise.

Recommendation

  • Immediately update the WP Duplicate plugin to a version beyond 1.1.11 if a patch is available.
  • If a patch is not immediately available, disable or remove the WP Duplicate plugin from the WordPress environment until an update is applied.
  • Audit the WordPress web root and media directories for unauthorized executable files (e.g., .php, .php5, .phtml) uploaded by unknown users.
]]>highadvisorywordpressvulnerabilityrcefile-upload