Is CVE-2026-39474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39474 being exploited in the wild.

How severe is CVE-2026-39474?

High severity, with a CVSS score of 8.8, published 15 June 2026.

Which products and versions are affected?

Metaphor Creations Post Duplicator <= 3.0.10.

Is there a fix for CVE-2026-39474?

A patch was published on 2026-04-13: Version 3.0.11 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39474 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39474?

Check whether you run Metaphor Creations Post Duplicator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39474: Metaphor Creations Post Duplicator PHP Object Injection

Q: Is there a fix for CVE-2026-39474?

A patch was published on 2026-04-13: Version 3.0.11 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39474 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-39474?

Check whether you run Metaphor Creations Post Duplicator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39474 · Severity: high · CVSS 8.8 · Published 2026-06-15

Post Duplicator, a WordPress plugin used to clone posts and pages, contains a security flaw that allows users with 'Contributor' level access to execute unauthorized actions. By exploiting this vulnerability, an attacker could potentially take control of the website, access sensitive data, or disrupt site operations. This is particularly concerning for sites that allow multiple users to create content, as it elevates the risk of a complete site compromise.

Technologies: Metaphor Creations Post Duplicator. Vendors: Metaphor Creations.

Quick answers

Is CVE-2026-39474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39474 being exploited in the wild.
How severe is CVE-2026-39474?: High severity, with a CVSS score of 8.8, published 15 June 2026.
Which products and versions are affected?: Metaphor Creations Post Duplicator <= 3.0.10.
Is there a fix for CVE-2026-39474?: A patch was published on 2026-04-13: Version 3.0.11 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39474 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39474?: Check whether you run Metaphor Creations Post Duplicator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Post Duplicator plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 3.0.10. This issue stems from the insecure deserialization of user-supplied input (CWE-502) provided by an authenticated user with Contributor-level permissions or higher. An attacker can exploit this by submitting a specially crafted PHP serialized string, which, if a suitable Property-Oriented Programming (POP) chain is present in the environment, could lead to remote code execution, file deletion, or unauthorized database access. The vulnerability is resolved in version 3.0.11.

Affected products

Metaphor Creations Post Duplicator <= 3.0.10

Timeline

2026-01-28: other: Reported by Nguyen Ba Khanh
2026-04-13: advisory: Initial advisory published by Patchstack
2026-04-13: patched: Version 3.0.11 released to address the vulnerability
2026-06-15: disclosed: CVE published to NVD

References

https://patchstack.com/database/wordpress/plugin/post-duplicator/vulnerability/wordpress-post-duplicator-plugin-3-0-10-php-object-injection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.