WP Duplicate Vulnerability CVE-2026-123751 Exploited in the Wild, No Patch Available
Do Son 
TL;DR
WPScan reports that attackers are exploiting CVE-2026-123751, an unpatched WP Duplicate vulnerability that leads to remote code execution. The flaw affects WP Duplicate, formerly LocalSync, up to version 1.1.11. According to WPScan, “This vulnerability is being actively exploited in the wild.”
An authentication bypass lets unauthenticated attackers upload any file to a WordPress site running WP Duplicate. No fix exists yet. Remove or disable the plugin now.
- CVE: CVE-2026-123751
- CVSS: Awaiting analysis
- Product: Unknown WP Duplicate
- Affected: ≤ 1.1.11
- Impact: WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass
- Status: Exploited in the wild
- Action: See vendor advisory
Why It Matters
WP Duplicate clones and migrates WordPress sites between servers. The vendor lists “over 200 active installations,” so the user base is small. However, each exposed site is at full risk, because a single upload can hand over the server.
The plugin also has an earlier unpatched issue. Patchstack tracks CVE-2026-39755, a subscriber-level arbitrary file upload in the same versions, with “No official patch available.”
So far, WPScan has not shared attack volumes, dates or indicators of compromise. Even so, an unauthenticated upload bug with no patch is an easy target for automated scanners.
How the Attack Works
WPScan says the plugin “does not properly verify a request authentication value.” In addition, it “does not validate the path or type of uploaded files.” Together, these gaps let attackers “write arbitrary files to the server and achieve remote code execution.” No login is needed. Researcher Mike Gozdiskowski reported the flaw.
Affected Versions
- WP Duplicate (formerly LocalSync) 1.1.11 and earlier
Patch and Mitigation
WPScan lists “No known fix” for this WP Duplicate vulnerability. Therefore, site owners should:
- Deactivate and delete the plugin until a patched release appears.
- Check the uploads folder and plugin directories for unexpected PHP files.
- Review admin accounts and rotate passwords if you find signs of compromise.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
