CVE-2026-39755

Summary

This vulnerability allows an attacker to upload arbitrary files to a WordPress site using the WP Duplicate plugin, leading to potential remote code execution or data leakage.

Exploitability

Exploitation is relatively straightforward as it requires an authenticated user with the ability to upload files, which is a common pre-condition in many WordPress installations.

Blast radius

If exploited, the impact could be severe, as it could lead to full compromise of the WordPress site, including data theft or remote code execution.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WP Duplicate version 1.11.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.