Live › vulnerability › CVE-2026-115251
Go to dashboardThe Duplicator WordPress plugin before 5.0.0 exposes its one-click upgrade routine without authentication and without a permission check. A multisite child-site administrator who is not a network administrator can use it to install and run arbitrary PHP in the shared plugin directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the Duplicator WordPress plugin before 5.0.0. The description points to multisite networks, where a child-site administrator can reach the shared plugin directory; single-site installs are not described as affected by the multisite path. Teams not running Duplicator, or already on 5.0.0 or later, can skip it.
No product ranges from the sources yet.
wp plugin get duplicator --field=version5.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-115251")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.