CVE-2026-1499: 
WordPress vulnerability analysis and mitigation

CVE-2026-1499 is a Missing Authorization vulnerability in the WP Duplicate (local-sync) plugin for WordPress that allows arbitrary file upload leading to remote code execution. All versions up to and including 1.1.8 are affected. The vulnerability was published on February 6, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 8.8 (High) per NVD, though ENISA rates it 9.8 (Critical) under a slightly different vector (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862: Missing Authorization) on the process_add_site() AJAX action in class-local-sync-admin.php, which allows any authenticated subscriber-level user to set the internal WordPress option prod_key_random_id (Wordfence). Once this option is set, an unauthenticated attacker can use the known value to bypass authentication checks in handle_upload_single_big_file() (located in class-local-sync-handle-server-requests.php), combined with path traversal in the file upload functionality (class-local-sync-files-op.php), to write arbitrary files anywhere on the server (EUVD). The attack chain requires two actors or two steps: a low-privileged authenticated user to prime the option, followed by an unauthenticated request to upload a malicious file such as a PHP web shell.

Successful exploitation results in full remote code execution on the affected WordPress server, granting an attacker complete control over confidentiality, integrity, and availability of the system. An attacker can read sensitive data (database credentials, user data), modify or delete site content, and potentially pivot to other systems on the same hosting environment (Wordfence, Red Hat CVE). The unauthenticated file write capability makes this particularly severe for shared hosting environments where lateral movement to co-hosted sites is possible.

As of the time of reporting, no public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0147 (1.47%), indicating a relatively low but non-negligible probability of exploitation in the near term. The two-stage attack chain (requiring at least subscriber-level access to prime the option before unauthenticated exploitation) slightly raises the bar compared to a fully unauthenticated single-step exploit, though subscriber accounts are often trivially obtainable on open-registration WordPress sites.

1. Reconnaissance: Identify WordPress sites running the WP Duplicate (local-sync) plugin version ≤ 1.1.8 using tools like WPScan, Shodan, or by checking /wp-content/plugins/local-sync/readme.txt for version disclosure.
2. Obtain subscriber-level access: Register a free account on the target WordPress site (if open registration is enabled) or use compromised credentials to authenticate as any subscriber-level user.
3. Set the prod_key_random_id option: As the authenticated subscriber, send a crafted AJAX POST request to wp-admin/admin-ajax.php targeting the process_add_site() action (which lacks a capability check), supplying a known/attacker-controlled value for the prod_key_random_id WordPress option.
4. Craft unauthenticated file upload request: Using the known prod_key_random_id value to bypass authentication in handle_upload_single_big_file(), send an unauthenticated HTTP POST request to the plugin's file upload endpoint with a malicious PHP file payload and a path traversal sequence to place the file in a web-accessible directory (e.g., wp-content/uploads/).
5. Achieve remote code execution: Access the uploaded PHP web shell via the browser or HTTP client to execute arbitrary commands on the server with the privileges of the web server process (Wordfence).

• Network: Unusual POST requests to wp-admin/admin-ajax.php with AJAX actions related to process_add_site from subscriber-level sessions; unauthenticated POST requests to the plugin's file upload endpoint (handle_upload_single_big_file) containing multipart file data with path traversal sequences (../) in filename parameters.
• File System: Unexpected PHP files (e.g., web shells) appearing in wp-content/uploads/ or other web-accessible directories; files with names containing encoded path traversal sequences; newly created .php files owned by the web server user in non-standard plugin or upload directories.
• Logs: WordPress access logs showing POST requests to admin-ajax.php with suspicious action parameters from low-privileged accounts; web server access logs showing requests to newly created PHP files in upload directories shortly after the AJAX action was invoked; error logs referencing class-local-sync-handle-server-requests.php or class-local-sync-files-op.php.
• Database: Changes to the wp_options table for the prod_key_random_id option, especially if modified by a subscriber-level user or at an unexpected time.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) following access to newly uploaded PHP files.

No official patch from the plugin vendor (Revmakx) was confirmed available at the time of disclosure; administrators should immediately disable or remove the WP Duplicate (local-sync) plugin from all WordPress installations running version 1.1.8 or earlier (Wordfence). As a workaround, restrict user registration to prevent untrusted subscriber accounts, and apply a Web Application Firewall (WAF) rule to block requests to the vulnerable AJAX actions. Audit the wp_options table for unexpected changes to prod_key_random_id and review upload directories for unauthorized PHP files. Monitor the WordPress plugin repository changeset for an updated version (WordPress Trac).

Wordfence published the vulnerability in their weekly WordPress vulnerability report for the week of February 2–8, 2026, highlighting it as a notable missing authorization issue (Wordfence Blog). The vulnerability was also included in the CISA vulnerability bulletin for the week of February 2, 2026, indicating broader government-level awareness (CISA Bulletin). Qualys added detection for this CVE (detection ID 530914) in their February 2026 application security detections release (Qualys).