CVE-2026-10749

A PHP Object Injection vulnerability exists in the WordPress Post Duplicatorplugin in versions up to and including 3.0.14. The plugin passes unsanitized user-controlled input to PHP's unserialize() function via the customMetaData parameter during the post duplication process.

An authenticated attacker with at least Contributor-level access can craft a malicious serialized payload. When deserialized, this instantiates arbitrary PHP objects. If a suitable gadget chain is present in the WordPress environment, this can escalate to Remote Code Execution, arbitrary file deletion, or Server-Side Request Forgery.

Post Duplicator copies post content including custom meta fields. The plugin reads the customMetaData parameter from the duplication request and calls unserialize() on it without first validating or sanitizing the input.

PHP Object Injection via unserialize() allows an attacker to control the class and properties of the resulting object. The real-world severity depends on available PHP classes (gadget chains) in the application context — common WordPress plugins and themes frequently introduce gadgets that make exploitation straightforward.

Attack vector: Authenticated network request with a crafted serialized string in the customMetaData parameter. Requires Contributor role or higher.

Depending on the gadget chains available in the target WordPress installation:

• Remote Code Execution (RCE) via a PHP file write gadget
• Arbitrary file deletion leading to site takeover or denial of service
• Server-Side Request Forgery (SSRF) for internal network reconnaissance
• Privilege escalation through object manipulation

Update Post Duplicator to version 3.0.15 or later. The patched version replaces the unsafe unserialize() call with a safe alternative that does not instantiate arbitrary PHP objects.

If an immediate update is not possible, restrict Contributor-level access or disable the Post Duplicator plugin until the patch can be applied.

• CVE-2026-10749 — NVD / CVE.org
• WPScan Vulnerability Database — 224c36b5
• Post Duplicator — WordPress.org Plugin Page

Discovered and responsibly disclosed by Md Minaruzzaman Shovon, full-stack developer and security researcher based in Bangladesh. Verified on Patchstack.