{"affected":[{"defaultStatus":"unaffected","product":"Post Duplicator","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.0.18","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121875","cwes":["CWE-269"],"description":"The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/543db6f0-78dd-4c18-ac64-fbcb122771bd/"}],"kev":null,"metrics":[],"modifiedAt":1794204027651,"publishedAt":1794204027651,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/543db6f0-78dd-4c18-ac64-fbcb122771bd/"}],"remediation":[],"revision":"90a6eab7ae578c0a4d2fb1e2ea5e9a7f1908c32cae55261df639f173f898a2d7","sources":[{"modifiedAt":1794204027651,"name":"CNA: WPScan","retrievedAt":1794208120482,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121875"}],"ssvc":null,"status":"published","title":"Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment","updatedAt":1794208120482}