The WP Duplicate WordPress plugin, formerly sold as LocalSync, has an unauthenticated file upload flaw that ends in remote code execution, and it is being exploited while no fixed release exists.
What happened
WPScan published CVE-2026-123751 on 9 November with a CVSS score of 9.8. The plugin does not properly verify the authentication value on an upload request, and it does not validate the path or the type of the file being written. Combining those two failures means an unauthenticated request can place an arbitrary file on the server, and on typical hosting that file then executes as PHP.
The CVE record states plainly that the vulnerability is being actively exploited in the wild. WPScan lists no known fix, and the affected range is every version through 1.1.11, so there is no safe version to upgrade to. The plugin's install base is small, reported at just over 200 active installations, but a single upload is enough for full site compromise.
Who is affected
- Any WordPress site with WP Duplicate, or its earlier LocalSync name, installed and active at version 1.1.11 or below.
- Sites inherited from a previous developer or agency where plugin inventory was never documented.
- Multisite installs, since one vulnerable copy exposes every site on the network.
- Hosting where uploaded files in wp-content are served as executable PHP, which is the common default on shared plans.
What to do now
Deactivate and delete WP Duplicate today. Do not wait for a patch that does not exist.
- Remove the plugin directory rather than only deactivating it, so the upload endpoint is gone entirely.
- Scan wp-content/uploads and plugin directories for recent PHP files you did not deploy.
- Check web server logs for unauthenticated POST requests to the plugin's endpoints, then review what those requests wrote.
- If anything suspicious is found, rotate database and hosting credentials, then restore from a known-good backup taken before the exposure.
- Inventory every installed plugin across client sites; abandoned plugins with no patch path should be removed, not monitored.
What this means for South African businesses
South African SME sites accumulate plugins from agencies, theme bundles and quick fixes, and the ones nobody remembers installing are the ones nobody patches. WP Duplicate is a good example of the worst case: exploited, no fix, and small enough that it will never appear on a mainstream advisory list. The realistic exposure for an SME is not this specific plugin but the fact that no one can produce a current plugin inventory for their site.
Source: CVE-2026-123751 record (WPScan).
Also on the blog
- GSocket Linux backdoor: detections up 356% on web servers
- Chrome CVE-2026-125350: exploited XML zero-day fixed in 157.0.8103.50
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.