HIGH 7.2 NVD

CVE-2026-121875

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site admini

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.

References

https://wpscan.com/vulnerability/543db6f0-78dd-4c18-ac64-fbcb122771bd/

Published: 2026-11-09 · Source: NVD · Feed updated: 2026-11-10

This high severity vulnerability with a CVSS score of 7.2 was published on 2026-11-09 via NVD.

vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.