CRITICAL 9.8 NVD

CVE-2026-123751

The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded fil

The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.

References

https://wpscan.com/vulnerability/3a3556f0-fc36-4f68-b826-406a7b4c3f9e/

Published: 2026-11-09 · Source: NVD · Feed updated: 2026-11-10

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-11-09 via NVD.

Risk Timeline

CVE Disclosed2026-11-09 · 0 days ago

Remediation Resources

Official Advisory

wpscan.com/vulnerability/3a3556f0-fc36-4f68-b826-406a7b4c3f9e/

vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.