PT-2026-6691

🗓️ 06 Feb 2026 00:00:00Reported by Positive TechnologiesType

WP Duplicate up to 1.1.8 has missing authorization enabling unauthorized file upload and potential code execution.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-1499	6 Feb 202608:25	–	attackerkb
Circl	CVE-2026-1499	6 Feb 202610:00	–	circl
CNNVD	WordPress plugin WP Duplicate 安全漏洞	6 Feb 202600:00	–	cnnvd
CVE	CVE-2026-1499	6 Feb 202608:25	–	cve
Cvelist	CVE-2026-1499 WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action	6 Feb 202608:25	–	cvelist
EUVD	EUVD-2026-5649	6 Feb 202608:25	–	euvd
NVD	CVE-2026-1499	6 Feb 202609:15	–	nvd
Patchstack	WordPress WP Duplicate plugin <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action vulnerability	6 Feb 202606:14	–	patchstack
RedhatCVE	CVE-2026-1499	7 Feb 202613:13	–	redhatcve
Vulnrichment	CVE-2026-1499 WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action	6 Feb 202608:25	–	vulnrichment

Source	Link
twitter	www.twitter.com/MNovofastovsky/status/2025510090850066592
plugins	www.plugins.trac.wordpress.org/browser/local-sync/tags/1.1.8/admin/class-local-sync-files-op.php
twitter	www.twitter.com/CveFindCom/status/2019821267864429001
twitter	www.twitter.com/cracbot/status/2021539752089165856
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/local-sync/trunk/includes/class-local-sync-handle-server-requests.php
twitter	www.twitter.com/CVEnew/status/2019691690991247469
twitter	www.twitter.com/0dayPublishing/status/2019696703335551185
plugins	www.plugins.trac.wordpress.org/browser/local-sync/tags/1.1.8/includes/class-local-sync-handle-server-requests.php
t	www.t.me/CVEtracker/43911

22 Feb 2026 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.19.8

EPSS0.0094

SSVC