CVE-2026-123751

{
  "etk_id": "ETK-2026-3933",
  "cve_id": "CVE-2026-123751",
  "display_id": "CVE-2026-123751",
  "ghsa_id": "GHSA-v9cp-82qp-rrj6",
  "euvd_id": "EUVD-2026-119835",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file upload in WP Duplicate",
  "summary": "WP Duplicate versions through 1.1.11 are affected by an upload validation flaw. An unauthenticated remote attacker may write arbitrary files to the server and potentially execute code when the vulnerable plugin is installed and reachable.",
  "mitigation": "Disable and remove WP Duplicate from affected WordPress sites until a vendor update is available. Restrict public access to WordPress administrative and plugin-related endpoints to reduce exposure where removal cannot happen immediately.",
  "vendor": null,
  "product": "WP Duplicate",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.1.11"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WP Duplicate",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 9.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0028,
  "epss_percentile": 0.2027,
  "epss_asof": "2026-11-09",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.013797933333333333,
  "t0_at": "2026-11-09T06:00:29.165000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-09T15:30:53.714247+00:00",
      "days": 0.39611746813657406,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T06:00:29.165000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-11-07T00:00:00+00:00",
      "days": -2,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T06:00:29.165000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-123751"
    },
    "trigger_signal": {
      "at": "2026-11-09T06:00:29.165000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T06:00:29.165000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123751"
    }
  }
}