Global News | November 11, 2026

The WP Duplicate vulnerability could allow unauthenticated attackers to upload arbitrary files and execute code on affected WordPress sites, according to security provider WPScan. The issue affects the WP Duplicate migration plugin through version 1.1.11 and is tracked as CVE-2026-123751.

WPScan says the flaw is being actively exploited in the wild. Its advisory lists no known fix, making it important for site owners to identify installations, stop using the affected plugin and investigate whether their sites show signs of compromise. The advisory does not provide a count of affected sites or details of individual attacks.

The issue concerns the WP Duplicate plugin, identified in WPScan as local-sync. It is not a vulnerability in WordPress core. Organizations should also avoid confusing it with other plugins whose names include “duplicate,” “migration” or “backup.”

Site administrators should confirm the plugin’s exact identity and version before acting. Where an affected installation is found, removing it addresses the exposed plugin but does not automatically remove malicious files or other changes an attacker may already have introduced.

What Is the WP Duplicate Vulnerability?

WP Duplicate is a WordPress plugin used for site duplication and migration. Such tools are useful when moving a website between environments, but they may remain installed after the migration is finished. An old plugin on a production or staging site can therefore remain part of the site’s attack surface even if administrators rarely use it.

WPScan says the WP Duplicate vulnerability stems from inadequate verification of a request authentication value, combined with insufficient validation of the path and type of uploaded files. According to its description, these weaknesses make it possible for an unauthenticated attacker to write arbitrary files to the server and achieve remote code execution.

Remote code execution means an attacker may cause the server to run instructions of the attacker’s choosing. The actual access and consequences depend on the server configuration, the privileges of the relevant process and any other security controls in place. The finding does not establish that every vulnerable site has been compromised.

The vulnerability identifier is CVE-2026-123751. WPScan credits researcher Mike Gozdiskowski and marks the finding verified. Its entry identifies versions through 1.1.11 as affected and shows “No known fix.” The status should be checked again before an administrator decides whether a later release is safe.

Active Exploitation: What Is Confirmed?

WPScan explicitly reports that the WP Duplicate vulnerability is being actively exploited in the wild. SecurityOnline also reported the exploitation claim, citing WPScan’s advisory. This is a security provider’s reported observation, not evidence that every site running the plugin has been attacked.

The public information reviewed for this article does not identify affected customers, provide a confirmed victim count or explain how many attack attempts succeeded. It also does not identify an attacker or establish that a particular criminal group is responsible.

These distinctions matter when responding to a security alert. A verified vulnerability describes a security weakness. An exploitation report indicates that attacks have been observed. A confirmed compromise of a specific website requires evidence from that website or its hosting environment.

The lack of publicly disclosed victim details does not make the risk theoretical. WPScan’s active-exploitation warning and the absence of a known fix in its listing justify prompt attention from administrators who use the affected plugin.

Which Sites and Plugin Versions Are Affected?

WPScan identifies WP Duplicate through version 1.1.11 as affected and associates its record with the plugin slug local-sync. Search for the exact plugin name, slug and installed version rather than relying on a similar-sounding product name.

Review production websites, staging installations, test copies and migration destinations. Agencies and hosting teams should include sites maintained for clients, including those where a previous provider may have installed the plugin for a one-time move.

An administrator who finds the WP Duplicate vulnerability on a site should review its operational use before removal. Deactivating and removing a migration plugin may affect an in-progress transfer, so coordinate with the responsible team and preserve relevant logs or evidence if compromise is suspected. Affected teams should not continue to leave an exposed vulnerable installation active merely to avoid inconvenience.

WPScan lists no known fix in the advisory reviewed for this report. That is a time-sensitive statement about the advisory, not a guarantee that no update will ever be released. Confirm any later patch against the current WPScan entry and official plugin or vendor information before reinstalling.

How the File-Upload Issue Can Lead to Code Execution

A file-upload function can serve a legitimate purpose during website migration. Security depends on checking who is allowed to request the operation, where a file may be written and what types of file are permitted.

WPScan says the plugin fails to properly verify a request authentication value and does not validate the path or type of uploaded files. Those weaknesses can allow an unauthenticated attacker to write arbitrary files to the server and achieve remote code execution.

The precise impact on a particular environment depends on how the server handles the written file, the permissions granted to the web process and other conditions. A suspicious file is a reason to investigate; it does not by itself reveal the full extent of an attacker’s access or prove that customer information was stolen.

The WP Duplicate vulnerability should also be distinguished from a separate WordPress core remote-code-execution story previously covered by NewsFlayer. Both concern WordPress security, but the affected software and underlying issues are different. Updating WordPress core alone should not be presented as a fix for a vulnerable third-party plugin.

Seven Critical Risks for Website Owners

The following are possible consequences of a successful compromise or delayed response. They are not outcomes confirmed on every website using WP Duplicate.

1. Unauthorized file placement: WPScan says the flaw allows unauthenticated attackers to write arbitrary files. The presence and location of any unauthorized files must be established for each site.
2. Remote code execution: The advisory says the issue can lead to code execution. An attacker’s effective privileges and reach will depend on the environment and cannot be inferred solely from the CVE.
3. Website content changes: A compromised web process may be able to alter content or redirect visitors if it has the necessary permissions. No general claim of defacement across affected sites is established by the advisory.
4. Credential exposure: Depending on server permissions and storage practices, application configuration or credentials could be accessible during a compromise. Treat potential exposure as an investigation question, not proof that all passwords were stolen.
5. Persistent access: An attacker who gains code execution might install additional files or change site configuration to retain access. Removing the original plugin does not prove that such changes are absent.
6. Impact on shared environments: Sites hosted on the same infrastructure may face additional risk if account isolation or permissions are inadequate. The vulnerability alone does not establish that every neighboring site has been affected.
7. Business and recovery disruption: Taking a site offline, investigating logs or restoring clean files may interrupt normal operations. The impact varies by organization and should be assessed rather than assumed.

These risks support a cautious response, but they must not be confused with confirmed victim counts, data theft or a named campaign. WPScan’s public entry does not provide those details.

Practical Steps for WordPress Administrators

Identify and contain the exposure

To assess the WP Duplicate vulnerability, inventory installed plugins across production and non-production sites. Look specifically for WP Duplicate and the local-sync slug, then record the installed version, where it is active and who depends on it. Retain relevant site and server logs according to your organization’s incident procedures.

Because WPScan lists no known fix, stop using the affected plugin, deactivate it and remove it after coordinating the operational impact and preserving evidence where needed. SecurityOnline recommends deactivation and deletion until a patched release is available. Use a trusted alternative if a migration is necessary, and remove temporary tools when the work is complete.

For a high-risk or apparently compromised site, consider restricting public access or isolating the environment while qualified personnel assess the situation. Do not rely on a general firewall rule as a guaranteed substitute for removing the vulnerable plugin; any targeted mitigation should be validated by a competent administrator.

Investigate for signs of compromise

Review web-server and hosting logs, file changes and newly created or altered administrator accounts. Examine plugin and theme directories, uploaded files and other areas writable by the web process for unexpected files, while taking care not to delete potential evidence before it is preserved.

Compare suspicious changes against a known-good baseline and legitimate maintenance activity. An unusual PHP file, account or request warrants investigation but is not automatically attributable to this vulnerability. Equally, the absence of an obvious indicator does not conclusively prove the site was never accessed.

Recover and verify

If compromise is suspected or confirmed, involve the hosting provider or an incident-response specialist. Follow an established recovery process, assess the scope of access and restore from a verified clean backup when appropriate. Consider rotating WordPress, hosting, database and other relevant credentials after securing the environment.

Review data-protection and notification obligations with qualified legal and privacy advisers if sensitive information may have been accessed. Avoid promising users that no data was exposed until the investigation supports that conclusion.

What Remains Unknown?

WPScan’s advisory reports exploitation but does not disclose a complete picture of who was affected, the number of attacks or what attackers did after gaining access. The information reviewed also does not establish a named threat actor or a confirmed worldwide victim total.

The current absence of a known fix is especially important, but it can change. Before publishing an update or reinstalling the plugin, check the latest advisory and official release information. A later version number alone should not be treated as proof of remediation without supporting guidance.

Owners of affected sites should preserve the distinction between the WP Duplicate vulnerability, suspicious activity and a confirmed compromise. The right response depends on evidence from each environment as well as the latest vendor and security-provider information.

Conclusion

WPScan says the WP Duplicate vulnerability, CVE-2026-123751, affects the plugin through version 1.1.11 and is being exploited in the wild. Its advisory lists no known fix and describes an unauthenticated file-upload issue that can lead to remote code execution.

Administrators should identify affected installations, stop using and remove the plugin, and assess sites for unauthorized changes. Removing the plugin is a containment measure—not proof that an earlier compromise has been eliminated.

Source note: This article draws on WPScan’s vulnerability advisory and SecurityOnline’s reporting. Exploitation is attributed to WPScan; no independent victim count or attacker identity was established.

NewsFlayer — Bringing You the Latest Cybersecurity News from Around the World.