CVE-2026-123751

Summary

The WP Duplicate WordPress plugin (≤1.1.11) lacks proper request authentication verification and file upload validation, allowing unauthenticated attackers to upload arbitrary files—including PHP scripts—to the server, leading to remote code execution.

Exploitability

Exploitation is trivial for unauthenticated attackers due to the absence of authentication checks and input validation on the file upload endpoint.

Blast radius

Successful exploitation grants full server compromise, enabling data theft, site defacement, or use as a pivot point for lateral movement within the hosting infrastructure.

Detection

Defenders should monitor WordPress debug logs and web server access logs for unexpected POST requests to wp-content/plugins/wp-duplicate/ endpoints involving file uploads (e.g., multipart/form-data with .php extensions) from unauthenticated sessions, especially with non-image file types or unusually large payloads. Also watch for newly created PHP files in upload directories not originating from legitimate WordPress admin actions.

Prioritized remediation

Upgrade to WP Duplicate plugin version 1.1.12 or later, which addresses the authentication bypass and file upload validation flaws.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.