Security notice
Use the WP Duplicate migration plugin? It is being attacked and there is no fix. Delete it today.
WP Duplicate, the WordPress Migration Plugin, versions 1.1.11 and earlier have CVE-2026-123751. Someone without a login can get past the plugin's request check and write any file to your server, then run it as code and take over the site. WPScan reports that it is being actively exploited, and there is no fixed version. Deactivate and delete the plugin today. (WPScan, NVD, WordPress.org)
What happened
- The flaw. WP Duplicate does not properly check a request's authentication value and does not check the path or type of uploaded files. Someone without a login can write any file to the server and run their own code. (WPScan, NVD)
- Attacks. WPScan says the flaw is being actively exploited. It will publish the technical details only once a fix exists. (WPScan)
- No fix. WPScan lists no known fix. The newest version on WordPress.org is 1.1.11, last updated June 16, 2026. (WPScan, WordPress.org)
- Severity. No CVSS score has been published yet. An unauthenticated flaw that leads to running code on the server is as serious as it gets. It is not on the CISA list of known exploited flaws. (NVD)
Who should worry
Any WordPress site with WP Duplicate installed, at any version up to 1.1.11. Its folder name and WordPress.org slug is local-sync. Migration plugins are often left behind after a move, so check sites you have not touched in a while. (WPScan, WordPress.org)
WordPress.org lists 200+ active installations. That is a plugin installation count, not a count of affected or compromised sites. (WordPress.org)
What to do now
- Deactivate and delete WP Duplicate today. Deleting it removes its files from the server. When you next need to move the site, use your host's migration tool or a maintained plugin.
- Look for signs of a break-in. Ask your developer or host to check for PHP files in
wp-content/uploads, files in plugin and theme folders that changed recently, and administrator accounts nobody on your team created. Deleting the plugin closes the flaw; it does not remove anything an attacker already placed. - If you find anything, treat the site as hacked. Restore from a clean backup taken before the break-in, then change the passwords for WordPress administrators, hosting, the database and FTP.
What to send your developer, agency or host
Please check whether our WordPress site has the WP Duplicate (WordPress Migration Plugin) plugin installed, folder local-sync. CVE-2026-123751 affects every version through 1.1.11: an unauthenticated authentication bypass and arbitrary file upload that leads to remote code execution. WPScan reports it is being actively exploited and there is no fix. Please deactivate and delete the plugin today, check uploads and plugin folders for unexpected PHP files and recent changes, review administrator accounts, and tell us what you found. Sources: WPScan, NVD.
Common questions
Does this mean my site was hacked?
No. Having the plugin installed is a reason to remove it and check the site, not proof of a break-in. Attacks are under way, so do not wait.
Is it safe if the plugin is deactivated?
Delete it rather than only deactivating it. A plugin you no longer use has no reason to stay on the server, and there is no fixed version to move to.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow WPScan, the NVD entry and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- WPScan: WP Duplicate 1.1.11 and earlier, unauthenticated arbitrary file upload via authentication bypass, actively exploited, no known fix, published November 6, 2026.
- NVD: CVE-2026-123751, published November 9, 2026, no score yet.
- WordPress.org: plugin version information (1.1.11, last updated June 16, 2026) and 200+ active installations.