PT-2026-6691 · WordPress · Wordpress+1

Athiwat Tiprasaharn · Published 2026-02-06 · Updated 2026-02-22 · CVE-2026-1499

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Duplicate versions up to and including 1.1.8

Description The WP Duplicate plugin for WordPress is susceptible to a missing authorization issue, leading to arbitrary file upload. This occurs because of a missing capability check on the process add site() AJAX action, combined with a path traversal issue in the file upload functionality. An authenticated attacker with subscriber-level privileges can set the internal prod key random id option. Subsequently, an unauthenticated attacker can utilize this to bypass authentication checks and write arbitrary files to the server using the handle upload single big file() function, potentially resulting in remote code execution. The process add site() AJAX action is involved in the initial stage of the attack.

Recommendations Update WP Duplicate to version 1.1.9.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1499

Affected Products

Wp Duplicate

Wordpress

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2026-1499 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3452904%40local-sync&old=3400317%40local-sync&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/11bb7190-023b-45e1-99a5-7313c489ef45?source=cve · Note
• https://twitter.com/MNovofastovsky/status/2025510090850066592 · Twitter Post
• https://plugins.trac.wordpress.org/browser/local-sync/tags/1.1.8/admin/class-local-sync-admin.php#L422 · Note
• https://plugins.trac.wordpress.org/browser/local-sync/trunk/includes/class-local-sync-handle-server-requests.php#L389 · Note
• https://twitter.com/cracbot/status/2021539752089165856 · Twitter Post
• https://t.me/cveNotify/151106 · Telegram Post
• https://cwe.mitre.org/data/definitions/862.html · Note
• https://plugins.trac.wordpress.org/browser/local-sync/trunk/admin/class-local-sync-files-op.php#L843 · Note
• https://plugins.trac.wordpress.org/browser/local-sync/trunk/admin/class-local-sync-admin.php#L422 · Note
• https://plugins.trac.wordpress.org/browser/local-sync/tags/1.1.8/admin/class-local-sync-files-op.php#L843 · Note
• https://twitter.com/CVEnew/status/2019691690991247469 · Twitter Post
• https://twitter.com/0dayPublishing/status/2019696703335551185 · Twitter Post
• https://t.me/CVEtracker/43911 · Telegram Post