CVE-2026-121874
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
The sources do not list affected products or versions for this vulnerability yet.
0.1%2nd percentile
Bar shows rank among all scored CVEs.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security