{"id":"EM-20261109-JOFT","url":"https://cyber.eventmonitor.net/incident/EM-20261109-JOFT/critical-wp-duplicate-vulnerability-cve-2026-123751/","type":"cve","title":"Critical WP Duplicate Vulnerability (CVE-2026-123751)","subtitle":"CVE-2026-123751","subject":"CVE-2026-123751","status":"Confirmed","severity":"critical","affected":[],"headline":"55 hours from first report to confirmed exploitation.","born":"2026-11-09T07:17:30.213Z","firstSignal":"2026-11-07T00:00:00.000Z","lastSignal":"2026-11-09T07:17:30.213Z","updated":"2026-11-13T09:51:01.211Z","revision":2,"life":[{"status":"Born","at":"2026-11-09T07:17:30.213Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-09T07:17:30.213Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-11-09T07:17:30.213Z","why":"exploitation in the wild reported"}],"changeLog":[{"at":"2026-11-07T00:00:00.000Z","what":"First signal: C30 VulnCheck KEV"},{"at":"2026-11-09T07:17:30.213Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261109-JOFT created."},{"at":"2026-11-09T07:17:30.213Z","what":"Severity raised to Critical by C6"},{"at":"2026-11-09T07:17:30.213Z","what":"Status: Confirmed (exploitation in the wild reported)"}],"stages":[{"name":"Disclosed","at":"2026-11-09T07:17:30.213Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T07:17:30.213Z","detail":"CVSS 9.8 · EPSS 0.3%"},{"name":"Exploited","at":"2026-11-09T07:17:30.213Z","detail":"C6 reports use in the wild"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-07T00:00:00.000Z","source":"C30","sourceName":"VulnCheck KEV","role":"Research & News","severity":3,"title":"CVE-2026-123751 known exploited (VulnCheck KEV): revmakx wp_duplicate Unrestricted Upload of File with Dangerous Type","text":"The WP Duplicate  WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This…","url":"https://vulncheck.com/browse/cve/CVE-2026-123751"},{"at":"2026-11-09T07:17:30.213Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-123751 (CVSS 9.8)","text":"The WP Duplicate  WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123751"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T07:17:30.213","score":9.8,"severity":"CRITICAL","desc":"The WP Duplicate  WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This…","product":"","seen":1794338539165},"kev":null,"epss":{"epss":0.00277,"pct":0.20271,"at":1794237520970},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}