CVE-2026-10749

The Post Duplicator WordPress plugin is affected by CVE-2026-10749 in versions before 3.0.15. During post duplication, attacker-supplied serialized values are stored without the WordPress meta API’s double-serialization protection, enabling PHP Object injection by users with Contributor-level acc...