CVE-2026-10749
High
Description
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.
SeverityHigh
CVSS7.2
Exploit probability46. percentile0.5%
ProductPost Duplicator
PublishedJun 24, 2026
First seenJun 24, 2026
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- Post Duplicator3.0.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Post Duplicator | v < 3.0.15 | 3.0.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.