CVE-2026-10749: Post Duplicator WordPress plugin PHP Object Injection in customMetaData

CVE-2026-10749 · Severity: info · CVSS 7.2 · Published 2026-06-24

The Post Duplicator plugin for WordPress, which allows users to easily clone posts and pages, contains a security flaw in how it handles custom data during the duplication process. An attacker with a low-level 'Contributor' account can exploit this to inject malicious code into the website's database. If successful, this could allow the attacker to take full control of the site, steal sensitive information, or delete files, depending on other software installed on the server.

Technologies: Metaphor Creations Post Duplicator. Vendors: Metaphor Creations.

Quick answers

Is CVE-2026-10749 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10749 being exploited in the wild.
How severe is CVE-2026-10749?
Informational severity, with a CVSS score of 7.2, published 24 June 2026.
Which products and versions are affected?
Metaphor Creations Post Duplicator < 3.0.15.
Is there a fix for CVE-2026-10749?
A patch was published on 2026-06-15: Fixed in version 3.0.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10749 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-10749?
Check whether you run Metaphor Creations Post Duplicator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Post Duplicator plugin fails to use the WordPress meta API's double-serialization protection when storing custom meta-data during post duplication. Specifically, the `duplicate-post` REST API endpoint allows users with Contributor-level access or higher to provide raw serialized PHP strings via the `customMetaData` parameter. Because the plugin stores these values directly without re-serialization, subsequent calls to `get_post_meta()` trigger WordPress's `maybe_unserialize()` function, leading to PHP Object Injection. If a suitable POP (Property-Oriented Programming) chain exists within the site's active themes or plugins, an attacker can achieve remote code execution (RCE), perform arbitrary file operations, or disclose sensitive data. This issue is fixed in version 3.0.15.

Affected products

  • Metaphor Creations Post Duplicator < 3.0.15

Timeline

  • 2026-06-03: disclosed: Publicly published by WPScan
  • 2026-06-15: patched: Fixed in version 3.0.15
  • 2026-06-24: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.