What’s Vulnerable › Vulnerabilities

CVE-2016-10944

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-13 · updated 2026-06-17
• Weakness: CWE-352

Description

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.

Affected products

• Wpmaz Multisite Post Duplicator: before 1.1.3 — fixed in 1.1.3

How to fix

Upgrade to a fixed version: Wpmaz Multisite Post Duplicator 1.1.3. Check the vendor advisory for mitigations.

References

• https://advisories.dxw.com/advisories/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do/
• https://wordpress.org/plugins/multisite-post-duplicator/#developers
• https://advisories.dxw.com/advisories/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do/
• https://wordpress.org/plugins/multisite-post-duplicator/#developers

Get alerted when CVE-2016-10944 or the next vulnerability affects your stack