CVE-2026-39474

Name of the Vulnerable Software and Affected Versions Post Duplicator versions prior to 3.0.11

Description The Post Duplicator plugin for WordPress allows authenticated attackers with contributor-level access and above to perform PHP Object Injection. This occurs through the deserialization of untrusted input, a process where a stored string is converted back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the plugin, the presence of one in another installed plugin or theme could enable the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 3.0.10.