{"affected":[{"defaultStatus":"unaffected","product":"Post Duplicator","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.0.18","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121874","cwes":["CWE-863"],"description":"The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/ab1e031e-8f04-477e-85ea-a110c0ffe55f/"}],"kev":null,"metrics":[],"modifiedAt":1794204027478,"publishedAt":1794204027478,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/ab1e031e-8f04-477e-85ea-a110c0ffe55f/"}],"remediation":[],"revision":"54195dae620914fe785e5e33abf4c64eb556d2692e4d92dea1a6db33d559c6b8","sources":[{"modifiedAt":1794204027478,"name":"CNA: WPScan","retrievedAt":1794208117748,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121874"}],"ssvc":null,"status":"published","title":"Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name","updatedAt":1794208117748}