Attackers exploit unpatched WP Duplicate plugin flaw

WPScan says attackers are actively exploiting CVE-2026-123751, an unpatched flaw in the WP Duplicate WordPress plugin, formerly called LocalSync. The vulnerability affects version 1.1.11 and earlier. It allows unauthenticated attackers to bypass a request authentication check and upload arbitrary files to a vulnerable site, potentially leading to remote code execution. Researcher Mike Gozdiskowski reported the flaw.

WPScan says there is no known fix. It has not published attack volumes, dates or indicators of compromise, so the scale of exploitation is unclear. The plugin’s vendor lists more than 200 active installations. Site owners are advised to deactivate and delete WP Duplicate until a patched release is available, and check upload and plugin directories for unexpected PHP files. If there are signs of compromise, they should review administrator accounts and change passwords.