top of page
Search

WP Duplicate Is Being Exploited, Has No Fix and Was Pulled From WordPress.org. Delete the Plugin, Then Check Its Upload Folder for Files You Did Not Put There

Writer: Patrick Duggan
Patrick Duggan
3 minutes ago
3 min read

If any WordPress site you run has the WP Duplicate plugin installed (its folder name is local-sync), deactivate it and delete it today. Do not wait for an update: there is no fixed version, and WordPress.org closed the plugin on November 9. Then look inside wp-content/uploads/local_sync/ for files you did not put there, PHP files above all. WPScan says the flaw is being exploited, and a ready-to-run public exploit appeared on GitHub on November 15.


WP Duplicate is a migration and backup plugin. Migration plugins tend to be installed for one move and then forgotten, so check every site, including staging copies and sites you no longer actively manage.



What is confirmed


CVE-2026-123751. WPScan, the CVE Numbering Authority, describes it as an unauthenticated arbitrary file upload in WP Duplicate through version 1.1.11, reached by getting past an improper authentication check, with no check on the path or type of the uploaded file. In its words, that makes it "possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution." The CVE record adds: "This vulnerability is being actively exploited in the wild." WPScan published it on November 6 and updated it on November 14. Its entry gives the fix status as "No known fix" and credits Mike Gozdiskowski. It publishes no indicators.


CVE-2026-39755. This is a separate, earlier record from Patchstack for the same version range: an arbitrary file upload that needs a logged-in subscriber account, scored CVSS 3.1 9.9. Patchstack says it was reported on May 24 and published on October 5, and lists "No official patch available". It credits Aurélien Bourdois. The public exploit names both CVE IDs.


The plugin is closed. The WordPress.org plugin directory reports WP Duplicate as closed as of November 9. A closed plugin gets no updates through the directory, so the update screen on your site will never offer you a fix.



What is not known


  • We found no attacker addresses or file hashes published for this campaign in the sources we read, so we have added nothing to our feed.

  • WPScan does not say how widely the flaw is being exploited or since when.

  • With the plugin closed, WordPress.org no longer shows an install count, so we cannot say how many sites run it.


What to do


  1. Find it. In each site's admin go to Plugins and search for WP Duplicate, or look for a wp-content/plugins/local-sync folder on the server. With WP-CLI, list the plugins on each site and look for local-sync.

  2. Remove it. Deactivate and delete it. If you still need to migrate a site, use a maintained tool.

  3. Check the upload folder. Look in wp-content/uploads/local_sync/ and below it, especially the backups folder, for any file you did not create, and above all for anything ending in .php or another executable extension. A backup plugin's folder should hold backups, not scripts.

  4. If you find a stranger's file, treat the site as compromised. Removing the plugin does not remove a file that was already planted. Keep a copy for investigation, then remove it, change every WordPress, database, hosting and FTP password, replace the secret keys in wp-config.php, and look for administrator accounts and scheduled tasks you did not create. If you can, restore from a backup made before the plugin's exposure.

  5. Stop PHP from running in uploads. WordPress never needs to execute PHP from wp-content/uploads. Blocking it at the web server or your web application firewall stops this whole class of attack, whatever plugin it comes through.


How we know


We read the CVE records for CVE-2026-123751 and CVE-2026-39755 from the CVE Services API, WPScan's and Patchstack's entries, and the WordPress.org plugin directory API, all on November 15. Our exploit harvester logged the public exploit repository on November 15 at 06:01 UTC. That marks when an exploit went public, not a sighting of attacks.


Our edge instruments watch HTTP traffic to our own web properties, which do not run WordPress. Across 419,868 edge-block records and 61,446 edge-canary records since October 16, none matched the plugin's upload folder. That measures only the follow-up request to a planted file, not the upload itself, and it says nothing about scanning of real WordPress sites.



Sources


If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.




Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.


Comments

Rated 0 out of 5 stars.
No ratings yet
Add a rating
bottom of page