EUVD-2026-93264
GHSA-c4hr-qwxf-4jw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain subscriber account
-
DeliveryAuthenticate to WordPress
-
ExploitUpload malicious PHP via WP Duplicate
-
ExecutionRequest uploaded web shell
-
PersistExecute code on server
-
ImpactFull site/server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account at subscriber level (the lowest privilege tier, matching CVSS PR:L) on a site running WP Duplicate plugin version 1.1.11 or earlier; the attacker invokes the plugin's file-upload feature to place an arbitrary (e.g., PHP) file. The primary limiting factor is that the site must permit the attacker to obtain a subscriber account - self-service user registration being enabled (WordPress 'Anyone can register' setting) makes this trivial, whereas sites with registration closed and no untrusted low-privilege users are substantially harder to exploit. No user interaction and no higher-privilege role are required; exploitation is remote and low-complexity once an account exists. |
| Impact | The CVSS 3.1 score of 9.9 (vector AV:N/AC:L/PR:L/UI:N/S:C) signals a serious network-exploitable flaw: remote, low-complexity, no user interaction, and only low privileges (PR:L) needed, with a scope change amplifying impact to full confidentiality, integrity, and availability loss (C:H/I:H/A:H). The vulnerability title 'Subscriber Arbitrary File Upload' is consistent with PR:L - exploitation requires only a subscriber-level account, the lowest authenticated WordPress role, which is trivially obtainable wherever user self-registration is enabled. As a CWE-434 unrestricted file upload, successful exploitation typically yields a web shell and remote code execution, which is why signal direction is uniformly bad. However, several real-risk signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV listing, and no public POC is referenced, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. The practical risk is therefore bounded by (a) the requirement for a subscriber account - environments with registration disabled are far less exposed - and (b) the real-world footprint of this specific plugin, which appears niche. Net: a technically critical flaw that warrants prompt patching on affected sites, but absent EPSS/KEV/POC data it cannot be confirmed as widely or actively exploited; prioritize sites that allow open user registration. |
| Exploit ScenarioDerived | An attacker registers (or uses) a low-privilege subscriber account on a WordPress site running WP Duplicate <= 1.1.11, then abuses the plugin's file-upload functionality to upload a malicious PHP file. Because the flaw requires no user interaction and only low privileges over the network (AV:N/AC:L/PR:L/UI:N), the attacker can request the uploaded file to execute a web shell and gain code execution on the server. No public exploit code is identified at time of analysis, so weaponization would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
RemediationAI
A fixed version is not stated in the supplied data, so treat the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/local-sync/vulnerability/wordpress-wp-duplicate-plugin-1-1-11-arbitrary-file-upload-vulnerability?_s_id=cve as the source of truth for the patched release and update the plugin as soon as a version later than 1.1.11 is published; if no fix is yet available, deactivate and remove the plugin entirely, which eliminates the upload endpoint at the cost of losing its duplication functionality. Where the plugin must stay active, close the account-creation path first: disable 'Anyone can register' in WordPress settings and audit existing Subscriber accounts, since the exploit requires a low-privilege account and self-registration removes that hurdle; the trade-off is that legitimate self-service signup is lost. Complement that by blocking execution in upload directories (for example an nginx location rule or Apache <Directory> directive denying PHP handlers under wp-content/uploads), which neutralises uploaded payloads but may break plugins that legitimately serve scripts from those paths, and by adding a WAF rule that rejects multipart uploads to the WP Duplicate endpoints from Subscriber-authenticated sessions, accepting the risk of false positives on legitimate bulk operations. As a detection step, review wp-content/uploads and any plugin-specific upload directories for unexpected .php, .phtml, .phar or double-extension files, and treat any such file as evidence of attempted exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-434, Unrestricted Upload of File with Dangerous Type, in the file-upload handling of the WP Duplicate plugin (CPE cpe:2.3:a:revmakx:wp_duplicate:*:*:*:*:*:*:*:*). WordPress grants the Subscriber role the lowest tier of authenticated capability, typically only profile self-management, so the plugin's upload endpoint is effectively exposing a privileged file-write primitive to any registered user. Because the check on file type/extension is missing or bypassable, an uploaded payload can be written into a web-accessible directory and, if the server executes PHP there, run in the context of the web server user. Success therefore depends on two environmental factors rather than on the flaw itself: the ability to obtain a Subscriber account (registration open versus closed) and whether the upload destination allows server-side execution, which is why the registry vector's scope change (S:C) and the independent assessment's S:U differ in how they frame blast radius even though both agree on full confidentiality, integrity and availability impact.
Know when Wp Duplicate gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Remote, low-complexity upload needing a subscriber account (PR:L, AV:N, UI:N); arbitrary file upload yields RCE giving full C/I/A, but impact stays within the WordPress host's authority so S:U.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
Executive ViewAI
A critical arbitrary file-upload flaw in the WordPress plugin WP Duplicate (versions up to and including 1.1.11) allows anyone who can obtain a basic Subscriber account to place executable files on the web server, which in practice can hand an attacker full control of the affected site. Any business unit running WordPress with self-service registration enabled is exposed, and because the plugin has no vendor-released fix at this time, remediation depends entirely on interim controls. Leadership should treat this as a site-takeover risk affecting brand trust, customer data held on those sites, and any connected corporate infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate WP Duplicate 1.1.11 and earlier; disable self-service and open Subscriber registration and require manual account approval; restrict upload functionality to trusted roles; block executable file uploads and prevent script execution in the uploads directory via web server configuration; deploy WAF rules targeting the plugin's file-upload endpoint; monitor file integrity and audit Subscriber accounts and recently written files for anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB