CVE-2026-10749 describes a deserialization vulnerability in the Post Duplicator WordPress plugin prior to version 3.0.15. The plugin does not safely process custom meta-data during post duplication, storing attacker-controlled serialized values without applying the WordPress meta API's double-serialization safeguards. This allows users with Contributor-level or higher privileges to inject arbitrary PHP objects, potentially leading to code execution or other impacts depending on the context of deserialization.

The vulnerability enables users with Contributor-level access and above to inject malicious PHP objects via unsafe deserialization of attacker-supplied serialized data. This could lead to unauthorized code execution or other malicious behavior within the WordPress environment. However, exploitation requires authenticated access at Contributor level or higher, limiting the attack surface to users with some level of trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Post Duplicator version 3.0.15 or later once available. Until then, restrict Contributor-level access and above to trusted users only to reduce risk.