CVE-2026-121874
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Nov 09, 2026
Vendor
unknown
Description
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.