Description
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Post Duplicator | < 3.0.18 | 3.0.18 |
References
- https://wpscan.com/vulnerability/ab1e031e-8f04-477e-85ea-a110c0ffe55f/ exploit vdb-entry technical-description