CVE-2026-123751 in WP Duplicate Plugin
Summary
by MITRE • 11/09/2026
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/09/2026
The WP Duplicate plugin version 1.1.11 and earlier contains critical security flaws that fundamentally compromise the integrity of WordPress installations by allowing unauthenticated actors to execute arbitrary code on the target server. The core issue stems from a failure to properly verify request authentication values, which effectively bypasses standard access controls designed to restrict administrative or privileged actions to authenticated users only. This lack of authentication verification means that any individual with network connectivity to the vulnerable site can interact with sensitive endpoints without providing valid credentials, turning what should be protected operations into publicly accessible functions.
In addition to the authentication failure, the plugin exhibits severe input validation deficiencies regarding file uploads. Specifically, it does not validate the path or type of files being uploaded by users. This oversight allows attackers to bypass standard MIME type checks and directory restrictions, enabling them to upload malicious scripts disguised as legitimate media files or other acceptable formats directly into executable directories on the web server. The combination of unauthenticated access and unrestricted file uploads creates a direct pathway for remote code execution, as an attacker can place a PHP shell or similar payload in a location where it will be automatically executed by the web server upon request.
The operational impact of this vulnerability is severe, leading to full compromise of the underlying WordPress environment. Once remote code execution is achieved, attackers gain the ability to read sensitive data such as user credentials and database contents, modify website content for defacement or phishing purposes, install additional malware including backdoors and cryptominers, and potentially pivot into other systems within the internal network if the server has broader connectivity. The fact that this vulnerability is being actively exploited in the wild significantly increases the urgency of remediation, as automated scanning tools and threat actors are already targeting vulnerable instances to establish persistent access and exfiltrate data without manual intervention or targeted attacks.
From a technical classification perspective, these flaws align with CWE-287 Improper Authentication, which describes cases where an actor is able to bypass authentication mechanisms, and CWE-434 Unrestricted Upload of File with Dangerous Type, which covers the ability to upload files that can be executed by the server. Furthermore, the exploitation technique maps directly to MITRE ATT&CK techniques such as T1505.002 Web Shell: PHP Web Shell for establishing persistent access and T1059.004 Command and Scripting Interpreter: Unix Shell for executing arbitrary commands on the compromised system. These mappings highlight how the vulnerability facilitates both initial compromise and subsequent lateral movement or persistence within the target environment.
To mitigate this risk, administrators must immediately update the WP Duplicate plugin to a version later than 1.1.11 where these authentication checks and file validation logic have been corrected by the developers. If updating is not immediately possible due to compatibility concerns, temporary mitigation strategies should include restricting access to WordPress admin directories via IP whitelisting in web server configurations or using Web Application Firewall rules that block requests lacking valid session tokens for upload endpoints. Additionally, implementing strict file type restrictions at the web server level and disabling PHP execution in media upload directories can provide a critical layer of defense against successful exploitation even if the application-level validation fails. Regular monitoring of server logs for unusual upload activity or unexpected script executions is also recommended to detect potential breaches early.