CVE-2026-39474— WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability
Quick assessment
Affected
metaphorcreations Post Duplicator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
metaphorcreations post duplicator是metaphorcreations个人开发者的一款WordPress内容复制插件。 metaphorcreations Post Duplicator 3.0.10及之前版本存在反序列化漏洞，该漏洞源于PHP对象注入，可能导致攻击者执行任意代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| metaphorcreations | Post Duplicator | n/a≤ 3.0.10 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-39474
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
metaphorcreations Post Duplicator 反序列化漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
metaphorcreations post duplicator是metaphorcreations个人开发者的一款WordPress内容复制插件。 metaphorcreations Post Duplicator 3.0.10及之前版本存在反序列化漏洞，该漏洞源于PHP对象注入，可能导致攻击者执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| metaphorcreations | Post Duplicator | n/a ~ 3.0.10 | - |
|
II. Public POCs for CVE-2026-39474
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39474
请登录查看更多情报信息。
News Coverage for CVE-2026-39474 (1)
IV. Related Vulnerabilities
Same product: Post Duplicator
-
CVE-2026-4244
Post Duplicator <= 3.0.11 - Missing Authorization to Authent -
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-10749
Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection -
CVE-2026-2301
Post Duplicator <= 3.0.8 - Missing Authorization to Authenti -
CVE-2025-24736
WordPress Post Duplicator plugin <= 2.35 - Broken Access Con
Same vendor: metaphorcreations
-
CVE-2026-94461
WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS -
CVE-2026-81274
WordPress Ditty plugin <= 3.1.67 - Broken Access Control vul -
CVE-2026-4244
Post Duplicator <= 3.0.11 - Missing Authorization to Authent -
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-27355
WordPress Ditty plugin <= 3.1.66 - Broken Access Control vul
Same weakness: CWE-502
-
CVE-2026-95603
WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP -
CVE-2026-18490
IBM Financial Transaction Manager (FTM) is Impacted by Multi -
CVE-2026-96560
LightLLM through 1.2.0 Unauthenticated Remote Code Execution -
CVE-2026-95928
recommenders-team recommenders Dict Loading mind_iterator.py -
CVE-2026-95897
Dask Loader core.py from_npy_stack deserialization
V. Comments for CVE-2026-39474
No comments yet