WordPress Post Duplicator Plugin Privilege Escalation Flaw

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Post Duplicator WordPress plugin before version 3.0.18 contains a critical privilege escalation vulnerability that bypasses role-based access controls. Site administrators on WordPress multisite networks can exploit insufficient capability validation in the plugin's permissions settings to grant themselves and other roles arbitrary capabilities—including Super Admin-level network management functions they should never possess. This affects multisite WordPress installations where site administrators have plugin management access, potentially allowing them to escalate privileges, manipulate user roles across the network, and gain unauthorized administrative control.

Casky's 224 matched security skills leverage Claude AI with extended reasoning to identify the attack patterns underlying TA0004 (Privilege Escalation) techniques. Practitioners using Casky would detect this vulnerability through skills that analyze capability validation failures, role-permission misconfigurations, and access control bypasses in plugin code. The platform's MITRE ATT&CK mapping would highlight how an attacker exploits CWE-269 (Improper Access Control) to execute privilege escalation—specifically showing how insufficient input validation on role permissions allows unauthorized capability assignment. Security teams would see findings correlating suspicious role modifications, unexpected capability grants to non-Super Admin accounts, and permission setting changes that deviate from baseline configurations, enabling them to identify compromised multisite installations before attackers achieve full network control.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-121875.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-121875

Casky has 224 skills that investigate the attack patterns behind CVE-2026-121875. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn