PT-2026-51668 · WordPress · Post Duplicator
CVE-2026-10749
·
Published
2026-06-24
·
Updated
2026-06-25
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Post Duplicator versions prior to 3.0.15
Description
Users with Contributor-level access and above can perform a PHP Object Injection. This occurs because the plugin fails to safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the double-serialization protection provided by the WordPress meta API. The issue involves the
customMetaData variable.Recommendations
Update Post Duplicator to version 3.0.15 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Post Duplicator