WP Duplicate – WordPress Migration Plugin
WP Duplicate – WordPress Migration Plugin has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 2 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 7.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Missing Authorization, behind 2 of the records (67%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
3 independent researchers contributed these findings, one record each. WP Duplicate – WordPress Migration Plugin is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2026-39755WP Duplicate – WordPress Migration Plugin <= 1.1.11 - Authenticated (Subscriber+) Arbitrary File Upload
Read the full analysisVulnerability Records
WP Duplicate – WordPress Migration Plugin
Author
revmakx
WP Duplicate (Formerly LocalSync) provides you with the easiest and the fastest way to clone or migrate a site from one server to another with the click of a button. The migration process is highly reliable and is proven to migrate bigger sites without any errors. Why WP Duplicate? Simplest Cloning Tool Just install the WP Duplicate plugin on the destination site and the live site and start syncing, no need to enter FTP details. Incremental Cloning Only the changed files are cloned from the source site to the destination site. So the cloning process is faster. Load Images From Live Site With WP Duplicate you can directly load the images of Live site, so that you do not need to copy media files which will save a lot of time during the cloning process. Clone Live Site To Local Computer With WP Duplicate you can clone any production site to your Local Computer (MAMP, LAMP, XAMP, etc..).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C