CVE-2026-39474: WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the WordPress Post Duplicator plugin (versions 3.0.10 and earlier) where attacker-controlled data is passed to PHP's unserialize() function without validation. Exploitation is reachable over the network and requires only a low-privilege WordPress account (Contributor role or equivalent). Successful exploitation gives the attacker full read, write, and availability impact on the host, which in practice means arbitrary code execution or complete data compromise depending on the PHP classes available in the application. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as the upstream maintainer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account (Contributor role or equivalent) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the vulnerability directly without relying on a victim to take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads arbitrary files on the host, including WordPress configuration files that contain database credentials and secret keys.
• Writes or overwrites files on the host, enabling injection of malicious PHP into the application or modification of stored content.
• Executes arbitrary code on the server if suitable PHP classes (gadget chains) are present in the application or its dependencies.
• Crashes or degrades the WordPress service by corrupting application state during deserialization.