CVE-2026-121875
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Nov 09, 2026
Vendor
unknown
Description
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.