CVE-2026-39755: WP Duplicate Path Traversal Vulnerability

CVE-2026-39755 Overview

CVE-2026-39755 is an arbitrary file upload vulnerability in the WP Duplicate WordPress plugin through version 1.1.11. The flaw allows authenticated users with Subscriber-level privileges to upload arbitrary files to the WordPress server. Because Subscriber accounts are the lowest-privilege authenticated role and are often created through open registration, this issue significantly lowers the barrier to full site compromise. The weakness is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated Subscriber can upload arbitrary files to the WordPress host, enabling remote code execution and full site takeover.

Affected Products

WP Duplicate WordPress plugin (local-sync) versions <= 1.1.11
WordPress installations with open user registration and the vulnerable plugin active
Managed and self-hosted WordPress environments running the affected plugin

Discovery Timeline

2026-10-06 - CVE-2026-39755 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-39755

Vulnerability Analysis

The WP Duplicate plugin exposes a file upload endpoint that fails to enforce proper capability checks and file type validation. A user holding the WordPress Subscriber role can reach the upload handler and submit arbitrary file content, including PHP source files or other executable payloads. Because WordPress serves files from the uploads directory over HTTP, an uploaded script can be requested directly to achieve code execution within the web server context.

The scope change in the vulnerability vector indicates that successful exploitation affects resources beyond the plugin's own security boundary, such as the broader WordPress installation and underlying host.

Root Cause

The root cause is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The plugin does not adequately restrict file extensions, MIME types, or caller capabilities on its upload functionality. Subscribers, who should only be allowed to manage their own profile, can therefore invoke privileged administrative functionality intended for site operators.

Attack Vector

Exploitation requires network access to the WordPress site and a valid Subscriber account. On sites with open registration enabled, an attacker can self-provision the required account. The attacker then submits a crafted multipart upload request to the vulnerable plugin endpoint, places a PHP payload in the uploads directory, and requests the file URL to execute code. See the Patchstack advisory for WP Duplicate for additional detail.

Detection Methods for CVE-2026-39755

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) under wp-content/uploads/ or plugin-managed directories.
POST requests to WP Duplicate (local-sync) plugin endpoints originating from accounts holding only the Subscriber role.
New administrator accounts, modified wp_options entries, or scheduled tasks created shortly after an upload event.
Outbound connections from the web server to unfamiliar hosts following a plugin upload request.

Detection Strategies

Inspect WordPress audit logs for admin-ajax.php or REST calls to WP Duplicate endpoints by low-privilege users.
Scan the uploads directory for files whose extensions do not match their MIME type or that contain PHP tags.
Correlate web server access logs with WordPress authentication events to flag Subscriber accounts invoking privileged actions.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and all active plugin directories.
Forward WordPress and web server logs to a centralized analytics platform for retention and query.
Alert on creation of PHP files under paths that should only contain media assets.

How to Mitigate CVE-2026-39755

Immediate Actions Required

Deactivate the WP Duplicate plugin on all affected WordPress sites until a patched release is installed.
Disable open user registration or restrict the default role for new accounts to limit who can reach the vulnerable endpoint.
Audit existing Subscriber accounts for unexpected activity and remove any accounts that were not legitimately created.
Review wp-content/uploads/ for unauthorized files and remove any PHP or script payloads.

Patch Information

No fixed version is listed in the current advisory. Monitor the Patchstack advisory for WP Duplicate and the plugin's WordPress.org page for a release above 1.1.11 that addresses the arbitrary file upload issue.

Workarounds

Block execution of PHP files inside wp-content/uploads/ using web server configuration.
Deploy a web application firewall (WAF) rule that denies multipart uploads to WP Duplicate endpoints from non-administrator sessions.
Restrict access to the WordPress admin and AJAX surfaces to known IP ranges where feasible.

bash

# Apache: deny PHP execution within WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}