Attackers are exploiting an unpatched authentication bypass in the WP Duplicate WordPress plugin, tracked as CVE-2026-123751, according to a warning from WPScan. The flaw lets unauthenticated attackers upload arbitrary files to a site and reach remote code execution, and no fix exists.
How CVE-2026-123751 Turns One Upload Into Site Takeover
WPScan attributes the flaw to two failures in the plugin. It does not properly verify a request authentication value, and it does not validate the path or type of the files it accepts. Together, those gaps let an attacker with no account upload a file of their choosing, including executable code, and run it on the server.
WP Duplicate, formerly known as LocalSync, is affected in all versions up to and including 1.1.11. The vendor lists over 200 active installations, a small base by WordPress standards. Each exposed site is fully exposed, however, because a single upload yields code execution.
Second Unpatched Upload Flaw Tracked by Patchstack
Patchstack separately tracks CVE-2026-39755 in the same versions. That flaw is also an unpatched arbitrary file upload, but it requires subscriber-level access rather than none. Subscriber accounts are the lowest authenticated role on a WordPress site and are often available through open registration, so the second flaw adds a further route to the same outcome on sites that allow sign-ups.
What WPScan Has and Has Not Disclosed About the Attacks
WPScan reported active exploitation on November 9 but has not shared attack volumes, dates or indicators of compromise. The source of the discovery was researcher Mike Gozdiskowski, who reported the authentication bypass. The absence of indicators means site owners have no public list of file names, paths or addresses to check against their logs.
The vendor has issued no patch, and WPScan’s entry lists “no known fix.” The plugin’s advisory status leaves site owners with a single stated option: remove or disable WP Duplicate until a fixed release appears.
Why Abandoned or Niche Plugins Become Attack Targets
The case follows a familiar pattern in the WordPress ecosystem. Plugins with modest install counts receive less scrutiny than market leaders, and a missing authentication check on an upload handler is among the most dependable paths to remote code execution. Attackers also scan broadly for such handlers regardless of how many sites run the plugin, because automated tools make a 200-site target as cheap to probe as a 200,000-site one.
The case also shows how the line between disclosure and exploitation can disappear. Here the exploitation warning and the public vulnerability details arrived on the same day, with no patch available at either point. Administrators therefore learned of the flaw at the moment attacks were already underway, with a window of exposure that stays open until the vendor ships a fix or sites remove the plugin.
Whether the developer will respond remains unknown. The plugin’s rename from LocalSync to WP Duplicate and its limited install base do not by themselves indicate abandonment, but the vendor had not released a fixed version as of the WPScan report.
Reach of the Two WP Duplicate Flaws Across Plugin Versions
Both CVE-2026-123751 and CVE-2026-39755 cover WP Duplicate releases up to and including 1.1.11, so no installed version of the plugin named in the advisories escapes either flaw. The first requires no account of any kind. The second requires a subscriber login, which makes the pair a layered exposure: a site that blocks open registration still faces the unauthenticated upload route, while a site that allows it faces both.
The data cited for the exploitation warning comes from WPScan and Patchstack, two vulnerability databases that track WordPress plugin weaknesses. WPScan’s report names the researcher and the attack class but leaves out the numbers that would show how widespread the attacks are. With more than 200 active installations listed, the pool of vulnerable sites is small enough that each compromise is a noticeable share of it.
Because a successful upload leads to code execution, a compromised site could host further malicious content or be used to reach data stored on the same server. The reports do not say what attackers have done after gaining access.
