{"id":"CVE-2026-112244","kind":"vulnerability","aliases":["CVE-2026-112244"],"related":[],"title":"Duplicator WordPress plugin leaks server file paths to visitors","description":"The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.","summary":"The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 let unauthenticated users open some bundled PHP files directly. The resulting fatal error shows a stack trace with the server's absolute filesystem paths.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["duplicator","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-5.1.0-or-later"],"how_to_check":"- Check the installed Duplicator or duplicator-pro plugin version in the WordPress admin under Plugins.\n- Look for the plugin's bundled PHP files being reachable directly over HTTP and returning a fatal error or stack trace.","fix":"- Move the Duplicator and duplicator-pro plugins to `5.1.0` or later.","status":"open","published_at":"2026-11-04T06:16:59+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:23+00:00","updated_at":"2026-11-04T06:26:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Duplicator and duplicator-pro plugins to `5.1.0` or later.","reach":"internet","title":"Duplicator WordPress plugin leaks server file paths to visitors","impact":"low","summary":"The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 let unauthenticated users open some bundled PHP files directly. The resulting fatal error shows a stack trace with the server's absolute filesystem paths.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","duplicator","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"server filesystem paths disclosed to anonymous visitors","analyst_note":"","how_to_check":"- Check the installed Duplicator or duplicator-pro plugin version in the WordPress admin under Plugins.\n- Look for the plugin's bundled PHP files being reachable directly over HTTP and returning a fatal error or stack trace.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-5.1.0-or-later"],"who_is_affected":"Sites running the Duplicator or duplicator-pro WordPress plugin before 5.1.0 are exposed, because bundled PHP files can be requested directly and reveal paths in error output. Sites without these plugins, or running 5.1.0 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000682,"input_tokens":4146,"output_tokens":534,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112244':12A,15A '-2026':11A,14A '5.1.0':30B,60C,67C 'absolut':52B,100C 'access':72C 'bundl':36B,77C 'context':85C 'cve':10A,13A 'direct':39B,71C 'disclos':96C 'duplic':1A,16B,23B,25B,56C,62C 'duplicator-pro':61C 'error':43B,89C 'expect':84C 'fatal':42B,88C 'file':6A,38B,79C 'filesystem':53B,101C 'host':20B 'initialis':81C 'leak':4A 'let':31B 'open':34B 'packag':17B 'path':7A,54B,102C 'php':37B,78C 'plugin':3A,28B,58C,65C 'prevent':70C 'pro':26B,63C 'result':41B 'return':91C 'self':19B 'self-host':18B 'server':5A,50B,98C 'show':44B 'stack':46B,93C 'trace':47B,94C 'trigger':86C 'unauthent':32B,104C 'user':33B,105C 'visitor':9A 'without':82C 'wordpress':2A,21B,27B,57C,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Duplicator or duplicator-pro WordPress plugin before 5.1.0 are exposed, because bundled PHP files can be requested directly and reveal paths in error output. Sites without these plugins, or running 5.1.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["duplicator","low","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112244","severity":null,"published_at":"2026-11-04T06:16:59+00:00","modified_at":"2026-11-04T06:16:59+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}