CVE-2026-10749

The Post Duplicator WordPress plugin contains a vulnerability that allows attackers with contributor-level access and above to inject malicious PHP objects through untrusted input deserialization in versions up to 3.0.15. This flaw could be exploited further if another plugin or theme installed on the site introduces a POP chain, potentially enabling the attacker to delete files, steal sensitive information, or run arbitrary code.

Based on public CVE data (MITRE/NVD).