CVE-2026-10749: Post Duplicator Plugin PHP Object Injection (CVSS 7.2)

Technical summary

CVE-2026-10749 is a PHP object injection vulnerability in Post Duplicator that bypasses WordPress's meta API serialization protections. When duplicating posts, the plugin processes custom metadata fields and stores attacker-controlled serialized values directly to the database without double-serialization verification. This permits an authenticated user at Contributor level or above to craft a malicious serialized PHP object that, upon unserialization during post retrieval or rendering, instantiates gadget chains leading to code execution. The CVSS 3.1 score of 7.2 (HIGH) reflects the requirement for authenticated access but acknowledges high impact across confidentiality, integrity, and availability.

Business impact

Compromise of any WordPress site running the vulnerable plugin can lead to unauthorized code execution with the privileges of the web server process. An attacker with Contributor access (a common user tier on multi-author sites, agencies, or publishing platforms) can escalate to full site takeover, exfiltrate sensitive data, inject malware, or pivot to backend systems. For organizations using Post Duplicator to manage content workflows—particularly media companies, SaaS platforms, and agencies managing client sites—this creates significant operational risk and potential data loss or compliance violations.

Affected systems

Post Duplicator WordPress plugin versions prior to 3.0.15 are affected. The vulnerability requires the attacker to hold Contributor-level access or higher on the WordPress installation, meaning it is most dangerous on sites that grant post management permissions broadly or to freelancers and agency staff. Any WordPress deployment using Post Duplicator in its vulnerable range should be assessed for risk based on user access patterns.

Exploitability

The vulnerability requires authentication at Contributor level or above, which prevents exploitation by unauthenticated attackers or users with lower privileges (Subscriber, custom read-only roles). However, Contributor access is commonly granted on publishing platforms, multi-author blogs, and agency-managed sites, making the attack practical in many real-world scenarios. Exploitation does not require user interaction; an authenticated Contributor can inject and trigger the payload directly during post duplication. No public exploit code or active in-the-wild exploitation has been identified yet, but the technical barrier to weaponization is low for PHP developers familiar with object injection gadget chains.

Remediation

The immediate remediation is to upgrade Post Duplicator to version 3.0.15 or later. Organizations unable to upgrade immediately should review and restrict Contributor-level user access to only trusted staff, disable post duplication features via site configuration if possible, or isolate the plugin from production until patched. Consider disabling user account creation or applying role-based capability restrictions to reduce the attack surface.

Patch guidance

Update Post Duplicator to version 3.0.15 or later via the WordPress plugin dashboard (Plugins → Installed Plugins → Post Duplicator → Update) or via WP-CLI with `wp plugin update post-duplicator`. Verify the update by checking Settings or the plugin details page to confirm the installed version. Test post duplication functionality on a staging environment before deploying to production to ensure compatibility with custom post types and metadata configurations.

Detection guidance

Monitor for suspicious serialized object payloads in post meta entries, particularly those containing 'O:' notation (object markers) in wp_postmeta.meta_value. Review audit logs or security plugins for Contributor-level user accounts creating or duplicating posts with unusual frequency or timing. Database queries logging _add_post_meta or _update_post_meta calls with complex serialized structures warrant inspection. WordPress security plugins (e.g., Wordfence, Sucuri) may provide additional detection rules; verify plugin signatures and update security tool definitions.

Why prioritize this

This vulnerability merits priority patching because it combines moderate-to-high CVSS impact (7.2) with realistic access prerequisites. Contributor access is widely granted on production WordPress sites, particularly in publishing, SaaS, and agency contexts. The defect is straightforward to exploit once an attacker has the necessary credentials, and successful exploitation results in complete site compromise. The absence of KEV listing and public exploit code provides a narrow window to patch before widespread adoption of weaponized code. Organizations with lenient access controls or external contributor bases should patch immediately.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects high impact across confidentiality, integrity, and availability (C:H, I:H, A:H) combined with low attack complexity (AC:L) and network accessibility (AV:N). The score is moderated by the requirement for high-privilege authenticated access (PR:H), preventing worm-like propagation or anonymous exploitation. No scope change (S:U) limits inter-system impact, but the intrinsic ability to execute arbitrary code on the server justifies the HIGH rating. For organizations with restrictive Contributor access policies, the practical risk is lower; for those with broad delegation, risk is elevated.

Frequently asked questions