Description
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Post Duplicator | < 3.0.18 | 3.0.18 |
References
- https://wpscan.com/vulnerability/543db6f0-78dd-4c18-ac64-fbcb122771bd/ exploit vdb-entry technical-description