External risk intelligence

WP Duplicate Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-39755

The vulnerability affects a WordPress plugin, which functions as an extension of a web application. Such plugins are commonly installed on internet-facing web servers, making them accessible to external web requests in standard deployment scenarios.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the WP Duplicate plugin, which could allow unauthorized users to upload arbitrary files. This exposure affects web applications utilizing this specific plugin, potentially enabling attackers to compromise system integrity and confidentiality. The primary concern is to confirm if this plugin is in use and assess any associated exposure.

Plugin allows unauthorized file uploads.
Threat to system integrity and data confidentiality.
Confirm plugin use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with limited access could upload a malicious file to a website running a vulnerable version of the WP Duplicate plugin. This could allow them to execute arbitrary code on the server, potentially leading to complete system compromise.

Requires authenticated user access.
Triggered by uploading a crafted file.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload arbitrary files to the affected system when it is reachable via the network. This could potentially lead to the execution of malicious code or the modification of system files, impacting the integrity and availability of the service.

Arbitrary file upload capability.
Network-accessible endpoints.
System compromise or unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in WP Duplicate may require action from application owners and platform teams, as well as coordination with vendor-management if the plugin was sourced externally. The first practical step is to identify all instances of the affected plugin, determine their reachability and business criticality, and assign an owner for remediation planning based on risk.

Application owners should lead remediation efforts.
Verify plugin presence and exposure.
Plan maintenance for mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Duplicate plugin?

WP Duplicate is a WordPress plugin designed to help site administrators create copies of posts, pages, or entire sites. It functions as an extension within the WordPress ecosystem, allowing users to streamline content management tasks by duplicating existing web data.

What does CVE-2026-39755 mean?

This CVE refers to an Unrestricted Upload of File with Dangerous Type, classified as CWE-434. In simple terms, the plugin fails to properly validate the types of files users can upload. Because this check is missing, an attacker can submit malicious files to the server instead of the intended content.

How is this vulnerability triggered?

An attacker must have authenticated access to the site to initiate the file upload. Once they have that access, they can upload a specially crafted file to the server. Simply viewing the site or interacting with standard pages without performing an upload action does not trigger the vulnerability.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of risk because this plugin is typically used on internet-facing web servers. Since these servers are accessible to external web requests, they are reachable by attackers, making this vulnerability a relevant concern for most WordPress installations.

What should I do if I use WP Duplicate?

Your first step is to perform an inventory of your WordPress installations to confirm if the WP Duplicate plugin is active. Once identified, evaluate the criticality of those sites and coordinate with your team to plan for updates or removal to mitigate the risk of unauthorized file uploads.

References

patchstack.com/database/wordpress/plugin/local-sync/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.