WordPress Plugin Vulnerabilities
Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
Description
The plugin does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
Proof of Concept
Affects Plugins
Fixed in 3.0.18 References
CVE
Classification
Type
INCORRECT AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-11-06 (about 3 days ago)
Added
2026-11-06 (about 2 days ago)
Last Updated
2026-11-06 (about 2 days ago)
