{"id":"CVE-2026-121874","aliases":["EUVD-2026-119826","GHSA-q7h7-28h6-p557"],"status":"published","title":"Post Duplicator \u003c 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name","description":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00257,"percentile":0.17483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-11-09T06:00:27Z","modified":"2026-11-09T14:12:17Z","products":[{"vendor":"metaphor creations","product":"post duplicator"},{"vendor":"unknown","product":"post duplicator"}],"references":[{"url":"https://wpscan.com/vulnerability/ab1e031e-8f04-477e-85ea-a110c0ffe55f/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121874"},{"url":"https://wpscan.com/vulnerability/ab1e031e-8f04-477e-85ea-a110c0ffe55f"},{"url":"https://github.com/advisories/GHSA-q7h7-28h6-p557"}],"sources":{"cve":[{"id":"CVE-2026-121874","title":"Post Duplicator \u003c 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name","description":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.","status":"published","published":"2026-11-09T06:00:27.478Z","modified":"2026-11-09T14:12:17.071Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-09T15:33:44.265689Z"}],"euvd":[{"id":"EUVD-2026-119826","description":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.","status":"published","published":"2026-11-09T06:00:27Z","modified":"2026-11-09T14:12:17Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T15:17:13.549805Z"}],"ghsa":[{"id":"GHSA-q7h7-28h6-p557","title":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own...","description":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.","status":"published","published":"2026-11-09T09:31:42Z","modified":"2026-11-09T15:32:06Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-09T15:48:41.634645Z"}],"nvd":[{"id":"CVE-2026-121874","description":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.","status":"published","published":"2026-11-09T07:17:28.93Z","modified":"2026-11-10T16:28:46.51Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-09T18:15:14.951948Z"}]}}