CVE-2026-121875 in Post Duplicator Plugin
Summary
by MITRE • 11/09/2026
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The vulnerability identified in Post Duplicator versions prior to 3.0.18 represents a critical failure in access control logic within WordPress multisite environments. This flaw stems from an insufficient validation of user permissions when modifying role configurations through the plugin's administrative interface. Specifically, the software fails to verify whether the initiating request originates from a user with sufficient privileges to alter capability assignments for other roles. In a standard single-site installation, this might result in privilege escalation within that specific site, but in a multisite network architecture, the implications are significantly more severe due to the hierarchical nature of administrative rights.
In WordPress multisite setups, there is a distinct separation between regular Site Administrators and Super Admins. Regular administrators possess full control over their individual sites but lack authority over the broader network infrastructure or other sites within that network. The vulnerability allows any user designated as an administrator on any site in the network to bypass these restrictions. By exploiting this flaw, such users can modify role definitions to include capabilities that are strictly reserved for Super Admins. This effectively grants them elevated privileges that they should not possess according to the principle of least privilege and standard security models.
The technical mechanism involves a lack of capability checks during the processing of permission settings updates. When an administrator attempts to assign or remove capabilities from a role, the plugin does not cross-reference these actions against the current user's actual permissions within the multisite context. Consequently, arbitrary code execution is not required; instead, the attacker leverages legitimate administrative functions in an unauthorized manner. This aligns with CWE-269, which describes Improper Privilege Management, as well as CWE-862, Missing Authorization, where access to a resource or function is granted without proper verification of user rights.
The operational impact of this vulnerability allows for complete compromise of the multisite network's security posture. An attacker with low-level administrative access can elevate their privileges to that of a Super Admin. This enables them to manage all sites within the network, install and activate plugins across the entire infrastructure, modify core settings, and potentially execute arbitrary code on the server if combined with other vulnerabilities in installed themes or plugins. Furthermore, this elevation facilitates data exfiltration from any site hosted on the network, as well as potential persistence mechanisms that survive individual site deletions or resets.
This behavior is also consistent with ATT&CK technique T1078, Valid Accounts, specifically within the context of privilege escalation and lateral movement across a distributed system like WordPress multisite. The attacker uses valid credentials to gain higher-level access, which can then be used to move laterally between sites or maintain persistent control over the entire network infrastructure.
Mitigation strategies must prioritize immediate software updates. Administrators running Post Duplicator on versions earlier than 3.0.18 should upgrade to the latest patched version immediately upon availability. The developer has addressed this issue by implementing strict capability checks that ensure only users with Super Admin privileges can modify role capabilities in a multisite environment. Until an update is applied, administrators should consider restricting access to the plugin's settings pages or disabling the plugin entirely if it is not actively required for site operations. Additionally, enforcing strong password policies and multi-factor authentication for all administrative accounts reduces the risk of unauthorized exploitation by limiting the window of opportunity for attackers who may have obtained credentials through phishing or credential stuffing attacks. Regular auditing of user roles and capabilities across the multisite network can also help detect any unauthorized changes that may have occurred prior to patching.