Key points
- CVE-2026-82814 affects Duplicator up to 1.5.17 and Duplicator Pro up to 4.6.10.
- The flaw allows unauthenticated PHP object injection via deserialization of database content.
- A patch is available in version 5.0.0 or newer for the affected plugins.
Security researchers have identified a high-severity vulnerability in popular WordPress migration plugins. The flaw allows unauthenticated attackers to execute commands on affected servers through a specific sequence of actions.
What happened
Wordfence Argus discovered CVE-2026-82814, a PHP object injection vulnerability in the Duplicator and Duplicator Pro plugins. According to the National Vulnerability Database record, the flaw carries a CVSS score of 8.8, which is rated as high severity. The vulnerability exists in all versions of Duplicator up to and including 1.5.17. It also affects all versions of Duplicator Pro up to and including 4.6.10. The issue stems from the deserialization of untrusted database content within the DUPX_UpdateEngine::unserializeTest() function. This occurs during migration processes when the plugin performs database search-and-replace operations.
Attackers can exploit this by storing a serialized object in public site content. This carrier must be stored before an administrator creates a backup package. The exploitation requires a later administrator action to perform a migration or import. This triggers the deserialization of the malicious content. The National Vulnerability Database classifies the weakness as CWE-502, which relates to deserialization of untrusted data.
Why it matters
The impact varies between the free and pro versions of the plugin. Duplicator Free bundles a Requests 1.7 POP chain. This permits attacker-selected callbacks that result in direct operating-system command execution. Attackers can gain full control over the server hosting the WordPress site. Duplicator Pro uses an IndexList destructor gadget instead. This allows the deletion of an attacker-selected existing file. This is possible if the containing directory is writable by the installer PHP process.
Deletion of the wp-config.php file can expose the setup wizard. This may lead to site takeover and code execution. An attacker can achieve this if they reach the wizard first and supply a reachable database they control. The vulnerability is unauthenticated, meaning attackers do not need login credentials. As AppSec Scoop reported on 2026-10-20 regarding GLPI, unauthenticated flaws present significant risk. This incident highlights similar exposure in widely used migration tools.
What happens next
Users must update their plugins to resolve the vulnerability. Wordfence states that version 5.0.0 or newer patches the issue. Administrators should verify their current plugin versions immediately. Those running Duplicator should check if they are at or below version 1.5.17. Users of Duplicator Pro must ensure they are not on version 4.6.10 or older. Updating to the latest release is the only confirmed mitigation. No other workarounds are mentioned in the source material.
Patch priority
Teams usually begin by identifying systems exposed to the internet. Prioritise sites with high public traffic or those handling sensitive data. Check whether any staging environments are affected before updating production servers. Back up the database and file system before applying changes. Test the update in an isolated environment to ensure compatibility. Monitor logs for signs of exploitation during the rollout. If no fix exists, restrict access to the migration features. Limit administrative actions to trusted networks only. Review user permissions to minimise the attack surface.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: Duplicator
- Verify the version of Duplicator or Duplicator Pro installed on all managed WordPress sites.
- Update to version 5.0.0 or newer as soon as possible to apply the security patch.
- Monitor server logs for unusual file deletions or command execution attempts.
- Restrict access to plugin migration features to trusted administrators only.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Duplicator are affected by CVE-2026-82814?
All versions of Duplicator up to and including 1.5.17 are vulnerable. All versions of Duplicator Pro up to and including 4.6.10 are also affected.
Is the vulnerability authenticated or unauthenticated?
The vulnerability is unauthenticated, allowing remote attackers to exploit it without prior login credentials.
What is the impact of the flaw in Duplicator Free?
Duplicator Free allows direct operating-system command execution through an attacker-selected callback chain.
