CVE-2026-112244 · Package
NO FIX YET · SEE WHAT TO DO
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 let unauthenticated users open some bundled PHP files directly. The resulting fatal error shows a stack trace with the server's absolute filesystem paths.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Duplicator or duplicator-pro WordPress plugin before 5.1.0 are exposed, because bundled PHP files can be requested directly and reveal paths in error output. Sites without these plugins, or running 5.1.0 or later, are not affected.
Not affected if plugin-not-installed, version-5.1.0-or-later
Who cares duplicator, self-hosted, wordpress
5.1.0 or later.The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.