EUVD-2026-38694
GHSA-57q8-6wvw-p94h
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description requires only Contributor (low-privilege) access so PR:L not PR:H; network-reachable, low-complexity object injection yielding high C/I/A via gadget chains.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.
Articles & Coverage 2
AnalysisAI
PHP Object Injection in the Post Duplicator WordPress plugin before 3.0.15 lets authenticated users with Contributor-level access or higher inject arbitrary serialized PHP objects by abusing the plugin's post-duplication routine, which copies attacker-controlled custom meta-data without the WordPress meta API's double-serialization safeguard. Successful exploitation can lead to property-oriented programming attacks and, with a suitable gadget chain present, full compromise of the site. Publicly available exploit code exists (WPScan), though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 5th percentile).
Technical ContextAI
The root cause is unsafe deserialization (CWE-502, PHP Object Injection), even though the source feed lists CWE as N/A. WordPress normally protects post meta by double-serializing values through its meta API (add_post_meta/update_post_meta), so any serialized payload stored as a string is escaped and not re-interpreted as a PHP object on read. Post Duplicator's duplication logic bypasses this protection by writing attacker-supplied meta values directly, so when those values are later passed to unserialize() by WordPress or another plugin, an attacker-crafted serialized object is instantiated. If a usable POP gadget chain exists in WordPress core, the active theme, or other installed plugins, instantiation/destruction of those objects can be steered into arbitrary file operations, SQL, or code execution. The affected component is the Post Duplicator plugin (CPE cpe:2.3:a:unknown:post_duplicator), a tool that clones posts/pages and their metadata.
RemediationAI
Vendor-released patch: 3.0.15 - upgrade the Post Duplicator plugin to version 3.0.15 or later, which restores safe (double-serialized) handling of duplicated meta-data. Until the update can be applied, restrict the ability to create or duplicate content by reviewing and minimizing accounts holding Contributor or higher roles, and consider temporarily deactivating the Post Duplicator plugin if duplication is not actively needed (trade-off: editors lose the clone feature). As defense-in-depth, audit installed plugins/themes for known POP gadget chains since object-injection impact depends on their presence, and consider a WAF rule to flag serialized PHP payloads (e.g., 'O:' object markers) in post-edit requests, accepting possible false positives on legitimate serialized content. Refer to the WPScan advisory (https://wpscan.com/vulnerability/224c36b5-e604-4eb3-aad8-47283b95e994/) for specifics.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today