CVE-2026-121875: Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment

Q: Which deployments are exposed to this issue?

The issue affects WordPress multisite networks using Post Duplicator versions earlier than 3.0.18. It specifically involves administrators who are not Super Admins.

Q: What access does an attacker need to exploit it?

An attacker needs site-administrator access on the multisite network and access to the plugin’s permissions settings. They can then assign arbitrary capabilities to a role, including capabilities normally reserved for Super Admins.

Q: What is the likely security impact?

A non-Super-Admin site administrator can grant roles network-management capabilities reserved for Super Admins, resulting in privilege escalation within the multisite network.

Q: How can I determine whether I am affected?

Check whether Post Duplicator is installed on a WordPress multisite network and whether its version is earlier than 3.0.18. Review the plugin’s permissions settings and role capability assignments for unexpected network-management capabilities.

Published Nov 9, 2026

Updated

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.

Affected Software

1 affected component

Metaphor Creations Post Duplicator<3.0.18

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects WordPress multisite networks using Post Duplicator versions earlier than 3.0.18. It specifically involves administrators who are not Super Admins.

What access does an attacker need to exploit it?

An attacker needs site-administrator access on the multisite network and access to the plugin’s permissions settings. They can then assign arbitrary capabilities to a role, including capabilities normally reserved for Super Admins.

What is the likely security impact?

A non-Super-Admin site administrator can grant roles network-management capabilities reserved for Super Admins, resulting in privilege escalation within the multisite network.

How can I determine whether I am affected?

Check whether Post Duplicator is installed on a WordPress multisite network and whether its version is earlier than 3.0.18. Review the plugin’s permissions settings and role capability assignments for unexpected network-management capabilities.

CVE-2026-121875: Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

What is the likely security impact?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

What is the likely security impact?

How can I determine whether I am affected?