{"id":"CVE-2026-115251","kind":"vulnerability","aliases":["CVE-2026-115251"],"related":[],"title":"Duplicator WordPress plugin: upgrade routine lets attackers run PHP","description":"The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator  WordPress plugin before 5.0.0 directory.","summary":"The Duplicator WordPress plugin before 5.0.0 exposes its one-click upgrade routine without authentication and without a permission check. A multisite child-site administrator who is not a network administrator can use it to install and run arbitrary PHP in the shared plugin directory.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["duplicator","multisite","package","self-hosted","wordpress"],"not_affected_if":["duplicator-5.0.0-or-later"],"how_to_check":"- Check the installed Duplicator version in the WordPress admin plugin list or with `wp plugin get duplicator --field=version`\n- Confirm whether the site runs WordPress multisite with Duplicator network-activated","fix":"- Update the Duplicator plugin to `5.0.0` or later\n- Unknown whether a specific patched release or workaround is listed in the sources","status":"open","published_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:32+00:00","updated_at":"2026-10-25T06:37:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T06:37:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Duplicator plugin to `5.0.0` or later\n- Unknown whether a specific patched release or workaround is listed in the sources","reach":"internet","title":"Duplicator WordPress plugin: upgrade routine lets attackers run PHP","impact":"high","summary":"The Duplicator WordPress plugin before 5.0.0 exposes its one-click upgrade routine without authentication and without a permission check. A multisite child-site administrator who is not a network administrator can use it to install and run arbitrary PHP in the shared plugin directory.","category":"package","nicknames":[],"who_cares":["wordpress","duplicator","multisite","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary PHP code on the WordPress server","analyst_note":"Confirm the exact affected version range, whether single-site installs are exposed, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115251 for CVSS and patch details.","how_to_check":"- Check the installed Duplicator version in the WordPress admin plugin list or with `wp plugin get duplicator --field=version`\n- Confirm whether the site runs WordPress multisite with Duplicator network-activated","needs_analyst":true,"not_affected_if":["duplicator-5.0.0-or-later"],"who_is_affected":"Sites running the Duplicator WordPress plugin before 5.0.0. The description points to multisite networks, where a child-site administrator can reach the shared plugin directory; single-site installs are not described as affected by the multisite path. Teams not running Duplicator, or already on 5.0.0 or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3361,"output_tokens":622,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115251':12A,15A '-2026':11A,14A '5.0.0':28B,74C,93C,131C 'addit':95C 'administr':48B,54B,103C,114C 'allow':86C,101C 'arbitrari':62B,119C 'attack':7A 'authent':37B,100C 'check':42B 'child':46B,107C 'child-sit':45B 'click':33B,81C 'cve':10A,13A 'directori':68B,132C 'duplic':1A,16B,24B,70C,89C,127C 'expos':29B,96C 'host':21B 'instal':59B,88C,116C 'let':6A 'multisit':17B,44B,106C 'network':53B,113C,124C 'network-wid':123C 'one':32B,80C 'one-click':31B,79C 'packag':18B 'permiss':41B 'php':9A,63B,120C 'plugin':3A,26B,67B,72C,91C,129C 'restrict':77C 'routin':5A,35B,83C,98C 'run':8A,61B,118C 'self':20B 'self-host':19B 'share':66B,126C 'site':47B,108C 'upgrad':4A,34B,82C 'use':56B 'user':85C 'wide':125C 'without':36B,39B,99C 'wordpress':2A,22B,25B,71C,90C,128C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Duplicator WordPress plugin before 5.0.0. The description points to multisite networks, where a child-site administrator can reach the shared plugin directory; single-site installs are not described as affected by the multisite path. Teams not running Duplicator, or already on 5.0.0 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115251","severity":null,"published_at":"2026-10-25T06:16:32+00:00","modified_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}