CVE-2026-121874: Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name

Q: Who can exploit this issue?

An administrator of an individual site within a WordPress multisite network can exploit it if they are not already a Super Admin. The issue enables that administrator to overwrite options for their own site.

Q: What access does an attacker need?

The attacker needs authenticated administrator-level access to a site in a WordPress multisite network. No unauthenticated exploitation is described.

Q: What is the impact of successful exploitation?

A site administrator can update arbitrary site options, including role definitions. This can allow them to grant themselves network-management capabilities normally reserved for a Super Admin.

Q: Which versions are affected?

Post Duplicator versions earlier than 3.0.18 are affected. Version 3.0.18 is the first version identified as not affected.

Published Nov 9, 2026

Updated

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.

Affected Software

1 affected component

Inisev Post Duplicator<3.0.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Post Duplicator to a version that resolves this vulnerability.
Fixed in 3.0.18

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An administrator of an individual site within a WordPress multisite network can exploit it if they are not already a Super Admin. The issue enables that administrator to overwrite options for their own site.

What access does an attacker need?

The attacker needs authenticated administrator-level access to a site in a WordPress multisite network. No unauthenticated exploitation is described.

What is the impact of successful exploitation?

A site administrator can update arbitrary site options, including role definitions. This can allow them to grant themselves network-management capabilities normally reserved for a Super Admin.

Which versions are affected?

Post Duplicator versions earlier than 3.0.18 are affected. Version 3.0.18 is the first version identified as not affected.

CVE-2026-121874: Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What is the impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What is the impact of successful exploitation?

Which versions are affected?