WP Duplicate Vulnerability CVE-2026-123751 Exploited in the Wild, No Patch Available
WPScan reports that attackers are exploiting CVE-2026-123751, an unpatched WP Duplicate vulnerability that leads to remote code execution. The flaw affects WP Duplicate, formerly LocalSync, up to version 1.1.11. According to WPScan, “This vulnerability is being actively exploited in the wild.”
An authentication bypass lets unauthenticated attackers upload any file to a WordPress site running WP Duplicate. No fix exists yet. Remove or disable the plugin now.
Entenda a falha
A vulnerabilidade
CVE-2026-123751 is an unauthenticated arbitrary file upload in the WP Duplicate WordPress plugin (formerly LocalSync), through an authentication bypass. An attacker needs only network access to a site running the plugin, with no login, and can write arbitrary files to the server and reach remote code execution. Versions up to and including 1.1.11 are affected and no fixed version exists. WPScan says it is being actively exploited in the wild. A second flaw, CVE-2026-39755, is a subscriber-level arbitrary file upload in the same versions, tracked by Patchstack, also with no official patch.
Como funciona
The plugin clones and migrates WordPress sites between servers, so it accepts requests that carry files. A request reaches the plugin carrying an authentication value, which the plugin is supposed to check. It does not verify that value properly, so an unauthenticated request is treated as trusted. The plugin then accepts the uploaded file without validating its path or type, and writes it to the server. A file placed this way can then be run, which gives code execution.
Por que é vulnerável
According to WPScan, the plugin does not properly verify a request authentication value, and it does not validate the path or type of uploaded files. These are two missing checks that combine: the first lets anonymous callers past the gate, the second lets them put any file anywhere writable. No fix exists yet, so the articles do not describe what a fix would change. The articles also do not say why the flaw went unnoticed.
Como foi descoberta
According to the articles, researcher Mike Gozdiskowski reported the flaw. WPScan published the advisory and says it is being exploited in the wild, but has not shared attack volumes, dates or indicators of compromise. The earlier CVE-2026-39755 is tracked separately by Patchstack. The articles do not say how the researcher found the bug or when it was reported.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article names or links a published proof of concept. Because WPScan reports active exploitation, working exploitation exists in attacks, but no public copy is cited and its tooling is unknown. With no patch available and an unauthenticated upload, treat this as urgent: remove or disable the plugin and check the uploads and plugin folders for unexpected PHP files.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 06:15.
Linha do tempo
-
WP Duplicate Vulnerability CVE-2026-123751 Exploited in the Wild, No Patch Available
ler a análise desta fonte ocultar
WPScan reports that attackers are exploiting CVE-2026-123751, an unpatched WP Duplicate vulnerability that leads to remote code execution. The flaw affects WP Duplicate, formerly LocalSync, up to version 1.1.11. According to WPScan, “This vulnerability is being actively exploited in the wild.”
An authentication bypass lets unauthenticated attackers upload any file to a WordPress site running WP Duplicate. No fix exists yet. Remove or disable the plugin now.