Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
WP Duplicate - Security Vulnerability (CVE-2026-123751)
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
PLUGIN
WP Duplicate
CVE-2026-123751
Risk Score
Threat Entry
Updated 2026-10-06
WP Duplicate - Security Vulnerability (CVE-2026-39755)
Subscriber Arbitrary File Upload in WP Duplicate
PLUGIN
WP Duplicate
CVE-2026-39755
Risk Score
Threat Entry
Updated 2026-06-17
WP Duplicate - Remote Code Execution (CVE-2026-1499)
The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass authentication checks and write arbitrary files to the server via the `handle_upload_single_big_file()` function, ultimately leading to remote code execution.
PLUGIN
WP Duplicate
CVE-2026-1499
Risk Score