Description
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
Published: 2026-10-06
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary File Upload
Action: Immediate Patch
AI Analysis

Impact

A vulnerable version of the WP Duplicate plugin (1.1.11 and earlier) allows a subscriber to upload arbitrary files through the plugin interface.

Affected Systems

WordPress installations using the WP Duplicate plugin from the vendor revmakx, with versions 1.1.11 or older are affected.

Risk and Exploitability

The CVSS score of 9.9 indicates a high severity vulnerability. EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely local, requiring a subscriber privilege to access the plugin's upload feature; once exploited, an attacker can upload arbitrary files.

Generated by OpenCVE AI on October 7, 2026 at 05:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the WP Duplicate plugin to version 1.1.12 or later to remove the file upload flaw.
  • If an upgrade is not immediately possible, disable the plugin’s file upload capability or remove the plugin entirely until a fix is applied.
  • Configure WordPress to allow only approved MIME types and file extensions for uploads, and enable additional file scanning to prevent malicious content from being served.

Generated by OpenCVE AI on October 7, 2026 at 05:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
Title WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:37.844Z

Reserved: 2026-04-07T10:58:58.454Z

Link: CVE-2026-39755

cve-icon Vulnrichment

Updated: 2026-10-06T10:30:15.395Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:47.237

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-39755

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:30:13Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type