What the vulnerability does
01Description
The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass authentication checks and write arbitrary files to the server via the `handle_upload_single_big_file()` function, ultimately leading to remote code execution.
Explanation of Vulnerability in Simple Terms
02Summary
The WP Duplicate plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can perform administrative operations they should not have access to, including reading sensitive data, modifying site content, and disrupting site availability. All versions up to 1.1.8 are affected.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, and disrupt site availability without proper authorization.
Potential impact on your site
04Site Impact
Any low-privilege user can perform admin-level actions like duplicating sites, accessing backups, or modifying configurations.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
February 6, 2026
CVE published
April 14, 2026
Record updated
