What is the CVSS score of CVE-2026-39474?

CVE-2026-39474 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Post Duplicator are affected by CVE-2026-39474?

Post Duplicator WordPress plugin versions 3.0.10 and earlier contain a critical object injection vulnerability allowing authenticated users with contributor-level site access to execute arbitrary…

How to fix or mitigate CVE-2026-39474?

Within 24 hours: Audit contributor-level user accounts and revoke unnecessary access; document all installations of Post Duplicator plugin. Within 7 days: Immediately disable Post Duplicator plugin across all WordPress installations; identify and deploy suitable alternative for content duplication if business-critical; review access logs for suspicious contributor activity. Within 30 days: Monitor Patchstack security advisories for vendor patch release; perform comprehensive security assessment and malware scanning post-remediation.

Post Duplicator CVE-2026-39474

EUVD-2026-36937 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-gq8x-f6pq-64xj

PHP Deserialization Post Duplicator

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N), low complexity once Contributor account obtained (AC:L, PR:L), no user interaction, and deserialization-to-RCE yields full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:29 vuln.today

DescriptionCVE.org

Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.

AnalysisAI

PHP Object Injection in the Post Duplicator WordPress plugin versions <= 3.0.10 allows authenticated users with Contributor-level privileges to trigger insecure deserialization, potentially leading to remote code execution, data tampering, or full site compromise. The flaw is rated CVSS 8.8 (High) and was disclosed by Patchstack. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Post Duplicator is a WordPress plugin by metaphorcreations (CPE: cpe:2.3:a:metaphorcreations:post_duplicator) used to duplicate posts and pages within WordPress. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controlled input into PHP's unserialize() function (or equivalent), which instantiates PHP objects and triggers magic methods such as __wakeup() or __destruct(). When combined with a POP (Property-Oriented Programming) gadget chain present in WordPress core, other plugins, or themes, this primitive can be escalated from object instantiation into arbitrary code execution, file write, or SQL injection.

RemediationAI

No vendor-released patch identified at time of analysis based on the provided data - the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/post-duplicator/vulnerability/wordpress-post-duplicator-plugin-3-0-10-php-object-injection-vulnerability) should be consulted for the latest fixed version, and administrators should upgrade to any release newer than 3.0.10 once available. As compensating controls until a patched release is verified, deactivate and remove the Post Duplicator plugin (side effect: loss of duplication functionality), restrict Contributor-level account creation and audit existing Contributor accounts for suspicious users, and deploy a WordPress-aware WAF such as Patchstack or Wordfence with virtual patching for this CVE (side effect: requires subscription and may introduce false positives on legitimate post-edit workflows).