Multisite Post Duplicator
Multisite Post Duplicator has one disclosed vulnerability in the WordSec catalog, all reported in 2016; it remains unpatched as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Multisite Post Duplicator has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2016.
All of these findings were reported by Mallory Adams. Multisite Post Duplicator is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.8.30.
CVE-2016-10944Multisite Post Duplicator <= 1.7.6 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Multisite Post Duplicator
Author
MagicStick
Duplicate/Copy/Clone any individual page, post or custom post type from one site on your multisite network to another. Multisite Post Duplicator can copy the following: Custom fields Related post meta Custom post types on your network (make sure post type exists in your destination site) Featured image Images within post content Tags Categories. (If the category doesn’t exist in the destination site then the category is created and assigned to the post) Taxonomy terms. (make sure taxonomy is also registered on your destination site). Parent and child relationships (must use batch duplication option to achieve this). Site Media files to other sites on your network ACF Fields ACF Field Groups (sync field groups within your network!) Create a duplication link/syndication If you ever update the source post again it will automatically update the duplicated page and keep them in sync. Tools Batch Duplication Metabox control within Post/page edit screen Activity Log. View information on all duplications performed within your network Settings Settings page to customise the default behaviour Manage you linked duplications. Add/Remove. Restrict functionality to only certain sites on your network Restrict functionality to users of certain roles Select what status you want your new copy of post to be i.e Published, Draft etc Specify a prefix for the new post to avoid confusion Choose to ignore specific post meta keys in the duplication process Developers Create your own addons! Multisite Post Duplicator is now fully extendable. Create your own functionality. Check out the API documentation. Check out a list of hooks you can use (http://www.wpmaz.uk/multisite-post-duplicator-actions-and-filters/).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C