CVE-2026-115262 · Package
NO FIX YET · SEE WHAT TO DO
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict the database charset and collation values they rewrite during a restore. A Subscriber-level user can store a crafted value in their profile that breaks out of a string literal and injects SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of those charsets or collations.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Duplicator or Duplicator Pro WordPress plugin before 5.1.0 that allow Subscriber-level registration and use the restore feature onto a server missing a source charset or collation. The exposure depends on an administrator running a restore, so sites that never restore backups onto other servers are less exposed. Sites on 5.1.0 or later are not affected.
Not affected if no-open-subscriber-registration, no-restores-to-other-servers, version-5.1.0-or-later
Who cares duplicator, self-hosted, wordpress
wp plugin list.5.1.0The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.