{"id":"CVE-2026-115262","kind":"vulnerability","aliases":["CVE-2026-115262"],"related":[],"title":"Duplicator WordPress plugin: backup restore lets stored profile data inject SQL","description":"The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.","summary":"The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict the database charset and collation values they rewrite during a restore. A Subscriber-level user can store a crafted value in their profile that breaks out of a string literal and injects SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of those charsets or collations.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["duplicator","package","self-hosted","wordpress"],"not_affected_if":["no-open-subscriber-registration","no-restores-to-other-servers","version-5.1.0-or-later"],"how_to_check":"- Check the installed Duplicator or Duplicator Pro version in the WordPress plugins screen or `wp plugin list`.\n- Look for user profile fields that Subscriber accounts can write to, since those values end up in restore SQL.","fix":"- Duplicator and Duplicator Pro: `5.1.0`","status":"open","published_at":"2026-11-04T06:17:02+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","triaged_at":"2026-11-04T06:26:16+00:00","updated_at":"2026-11-04T06:26:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:16Z","model":"claude-haiku-5-5","output":{"fix":"- Duplicator and Duplicator Pro: `5.1.0`","reach":"internet","title":"Duplicator WordPress plugin: backup restore lets stored profile data inject SQL","impact":"high","summary":"The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict the database charset and collation values they rewrite during a restore. A Subscriber-level user can store a crafted value in their profile that breaks out of a string literal and injects SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of those charsets or collations.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","duplicator","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"SQL injection during restore may let a subscriber read or alter site database data","analyst_note":"Confirm the exact affected version range and whether a Subscriber account is enough to store the payload; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115262.","how_to_check":"- Check the installed Duplicator or Duplicator Pro version in the WordPress plugins screen or `wp plugin list`.\n- Look for user profile fields that Subscriber accounts can write to, since those values end up in restore SQL.","plain_action":"","needs_analyst":true,"not_affected_if":["version-5.1.0-or-later","no-open-subscriber-registration","no-restores-to-other-servers"],"who_is_affected":"Sites running the Duplicator or Duplicator Pro WordPress plugin before 5.1.0 that allow Subscriber-level registration and use the restore feature onto a server missing a source charset or collation. The exposure depends on an administrator running a restore, so sites that never restore backups onto other servers are less exposed. Sites on 5.1.0 or later are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000768,"input_tokens":4170,"output_tokens":701,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115262':14A,17A '-2026':13A,16A '5.1.0':32B,97C,104C 'administr':78B,148C 'backup':4A,81B,151C 'break':61B,131C 'charset':38B,89B,110C,161C 'collat':40B,91B,112C,163C 'craft':55B 'cve':12A,15A 'data':9A 'databas':37B,109C 'duplic':1A,18B,25B,27B,93C,99C 'duplicator-pro':98C 'host':22B 'inject':10A,68B,138C 'insert':74B,144C 'lack':85B,155C 'let':6A 'level':50B 'liter':66B,136C 'one':86B,156C 'onto':82B,152C 'packag':19B 'plugin':3A,30B,95C,102C 'pro':28B,100C 'profil':8A,59B,129C 'restor':5A,46B,72B,79B,119C,142C,149C 'restrict':35B,107C 'rewrit':43B,113C 'schema':115C 'self':21B 'self-host':20B 'server':84B,154C 'sourc':159C 'sql':11A,69B,139C 'statement':75B,116C,145C 'store':7A,53B,125C 'string':65B,135C 'subscrib':49B,124C 'subscriber-level':48B 'user':51B 'valu':41B,56B,122C 'wordpress':2A,23B,29B,94C,101C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Duplicator or Duplicator Pro WordPress plugin before 5.1.0 that allow Subscriber-level registration and use the restore feature onto a server missing a source charset or collation. The exposure depends on an administrator running a restore, so sites that never restore backups onto other servers are less exposed. Sites on 5.1.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["duplicator","package","selfhosted","unknown","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115262","severity":null,"published_at":"2026-11-04T06:17:02+00:00","modified_at":"2026-11-04T06:17:02+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","fetched_at":"2026-11-04T06:25:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}