---
id: "CVE-2026-115262"
kind: "vulnerability"
aliases: ["CVE-2026-115262"]
title: "Duplicator WordPress plugin: backup restore lets stored profile data inject SQL"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["duplicator", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-open-subscriber-registration", "no-restores-to-other-servers", "version-5.1.0-or-later"]
published_at: "2026-11-04T06:17:02+00:00"
first_seen_at: "2026-11-04T06:25:19+00:00"
updated_at: "2026-11-04T06:26:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115262", "first_seen_at": "2026-11-04T06:25:19+00:00"}]
---

# Duplicator WordPress plugin: backup restore lets stored profile data inject SQL

The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict the database charset and collation values they rewrite during a restore. A Subscriber-level user can store a crafted value in their profile that breaks out of a string literal and injects SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of those charsets or collations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Duplicator or Duplicator Pro version in the WordPress plugins screen or `wp plugin list`.
- Look for user profile fields that Subscriber accounts can write to, since those values end up in restore SQL.

## Fix

- Duplicator and Duplicator Pro: `5.1.0`

## Timeline

- 2026-11-04T06:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115262

## From the sources

The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_