WP Duplicate plugin: Arbitrary file upload by authenticated subscribers

Summary

WP Duplicate (local-sync), a WordPress plugin up to and including version 1.1.11, allows an authenticated user with the Subscriber role to upload arbitrary files to the server. An attacker who can obtain a Subscriber account, for example through open registration, may be able to upload executable code and take over the website. Patchstack rates the issue as high priority and expects exploitation, while CISA SSVC currently records no exploitation.

Affected

• WP Duplicate (slug local-sync) up to and including 1.1.11
• Required privilege: Subscriber account
• Related earlier CVE-2026-1499 affects versions up to and including 1.1.8 (missing authorization leading to arbitrary file upload)

Fixed in

Unknown. No vendor patch or fixed version has been confirmed as of the sources reviewed.

Workaround

• Deactivate and delete the plugin on production sites
• If it must remain, restrict user registration and review accounts holding the Subscriber role
• Review uploads and plugin directories for unexpected PHP or other executable files
• Patchstack has published a mitigation rule that blocks attacks until an official patch is available

Exploitation

• Not listed as known exploited (KEV) at the time of the sources reviewed
• No public proof of concept found for this CVE
• Patchstack expects exploitation; CISA SSVC assessment: exploitation none, automatable no, technical impact total
• NVD analysis is pending; exploitation data may be incomplete

Our recommendation

• Identify all WordPress sites with the WP Duplicate plugin installed, including staging and migration sites
• Remove the plugin if it is not essential, which is the only complete fix available
• Restrict or disable open user registration and review accounts with the Subscriber role
• Scan web roots for unexpected PHP files and monitor upload directories
• Check whether CVE-2026-1499 applies to any installed version and verify the status of both CVEs regularly

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-39755 patchstack.com
• GitHub advisory GHSA-r262-f4qm-hrp9 (CVE-2026-1499) github.com
• HOL Guard CVE-2026-39755 hol.org
• Strix CVE-2026-39755 www.strix.ai
• WordPress.org plugin page local-sync wordpress.org
• XeroWP local-sync xerowp.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:37.