{"id":"CVE-2026-82814","kind":"vulnerability","aliases":["CVE-2026-82814"],"related":[],"title":"Duplicator WordPress plugins: unauthenticated PHP object injection leads to command execution","description":"The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.","summary":"Duplicator (Free <=1.5.17, Pro <=4.6.10) unserializes database content in the standalone installer during migration. An unauthenticated attacker can plant a serialized object in public content such as a comment. It stays dormant until an admin builds a package and migrates. Free then gets OS command execution through a bundled Requests 1.7 POP chain. Pro gets deletion of an attacker-chosen file, and deleting wp-config.php can lead to takeover. CVSS 8.8.","severity":"high","cvss":8.8,"epss":0.0053,"exploited":false,"exploited_at":null,"products":[{"name":"Duplicator","fixed":["5.0.0"],"affected":"<= 1.5.17","ecosystem":"wordpress"},{"name":"Duplicator Pro","fixed":["5.0.0"],"affected":"<= 4.6.10","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["duplicator","duplicator-pro","package","php-object-injection","self-hosted","wordpress"],"not_affected_if":["managed-hosting","no-migration-performed","plugin-not-installed"],"how_to_check":"WordPress admin > Plugins: Duplicator Free <=1.5.17 or Duplicator Pro <=4.6.10 is vulnerable. Or run: wp plugin list --name=duplicator --fields=name,version. Packages and installers built on older versions stay vulnerable even after the plugin is updated. Whether a comment already carries a payload cannot be checked without a migration: unknown.","fix":"Update Duplicator Free and Duplicator Pro to 5.0.0 or newer (5.0.6 is current for Free). Then rebuild any existing packages with the patched release before migrating or restoring. Do not use archives built on older versions.","status":"open","published_at":"2026-10-21T02:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:22+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:22Z","model":"claude-haiku-5-5","output":{"fix":"Update Duplicator Free to a version later than 1.5.17 and Duplicator Pro to a version later than 4.6.10, as stated in the description; exact patched version numbers beyond those are unknown.","reach":"internet","title":"Duplicator WordPress plugins: unauthenticated PHP object injection leads to command execution","impact":"high","summary":"The Duplicator and Duplicator Pro WordPress plugins deserialize untrusted database content during migration, letting an unauthenticated attacker plant a serialized object in public site content. A later administrator migration then runs it, giving the attacker operating-system command execution in the Free version and file deletion, possibly site takeover, in Pro.","category":"package","who_cares":["wordpress","duplicator","duplicator-pro","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs operating-system commands on the server after an admin migration.","analyst_note":"Confirm the patched Duplicator Free and Pro versions and whether a migration-free exposure check exists at https://nvd.nist.gov/vuln/detail/CVE-2026-82814.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","plugin-not-installed"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000555,"input_tokens":3184,"output_tokens":474,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched Duplicator Free and Pro versions and whether a migration-free exposure check exists at https://nvd.nist.gov/vuln/detail/CVE-2026-82814.","search":"'-2026':13A,16A '-82814':14A,17A '1.5.17':36B,126C '1.7':84B,180C '4.6.10':38B,128C '8.8':104B 'action':269C 'admin':68B 'administr':157C,267C 'allow':143C 'attack':50B,93B,145C,186C,210C,243C 'attacker-chosen':92B 'attacker-select':185C,209C 'build':69B,158C 'bundl':82B,177C,199C 'callback':188C 'carrier':261C 'chain':86B,182C 'chosen':94B 'code':239C 'command':10A,78B,195C 'comment':62B 'contain':216C 'content':41B,58B,135C,154C 'control':253C 'creat':258C 'cve':12A,15A 'cvss':103B 'databas':40B,134C,170C,251C 'delet':89B,97B,206C,225C 'deseri':131C 'destructor':202C 'direct':191C 'directori':217C 'dormant':65B 'duplic':1A,21B,23B,34B,106C,108C,175C,197C 'duplicator':18A,19A 'duplicator-pro':22B 'dupx':137C 'execut':11A,79B,196C,240C 'exist':212C 'expos':229C 'file':95B,213C 'first':246C 'free':35B,74B,176C 'gadget':203C 'get':76B,88B 'host':32B 'import':167C 'includ':125C 'indexlist':201C 'inject':7A,29B,118C 'instal':45B,222C 'later':162C,266C 'lead':8A,100B,234C 'migrat':47B,73B,141C,165C,268C 'must':256C 'object':6A,28B,55B,117C,150C 'oper':193C 'operating-system':192C 'os':77B 'packag':25B,71B,160C,255C 'perform':163C 'permit':184C,205C 'php':5A,27B,116C,223C 'php-object-inject':26B 'plant':52B 'plugin':3A,110C 'pop':85B,181C 'pro':20A,24B,37B,87B,109C,198C 'process':224C 'public':57B,152C 'reach':244C 'reachabl':250C 'replac':174C 'request':83B,179C 'requir':271C 'respect':129C 'result':189C 'run':169C 'search':172C 'search-and-replac':171C 'select':187C,211C 'self':31B 'self-host':30B 'serial':54B,149C 'setup':231C 'site':153C,236C 'standalon':44B 'stay':64B 'store':147C,263C 'suppli':248C 'system':194C 'takeov':102B,237C 'unauthent':4A,49B,144C 'unseri':39B 'unserializetest':139C 'untrust':133C 'updateengin':138C 'version':121C 'via':130C 'vulner':114C 'wizard':232C 'wordpress':2A,33B,112C 'wp-config.php':98B,227C 'writabl':219C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T02:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82814","severity":null,"published_at":"2026-10-21T02:17:07+00:00","modified_at":"2026-10-22T19:18:02+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82814:524","url":null,"severity":null,"published_at":"2026-10-23T23:48:47+00:00","modified_at":"2026-10-23T23:48:47+00:00","first_seen_at":"2026-10-23T23:48:47+00:00","fetched_at":"2026-10-23T23:48:47+00:00","note":"Wordfence (primary researcher post), Tenable and securityonline agree: Free <=1.5.17 and Pro <=4.6.10 affected, fixed in 5.0.0 (released 2026-09-08). No in-the-wild exploitation or public PoC found. X posts were only restatements, none saved. NVD page returned empty; the Wordfence page text was truncated, so details come from search excerpts."},{"source":"epss","external_id":"CVE-2026-82814","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82814","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":2177,"url":"https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-high-severity-unauthenticated-php-object-injection-in-duplicator/","title":"Wordfence: Unauthenticated PHP Object Injection in Duplicator","kind":"advisory","source":"analyst","text":"Discovered Aug 30 2026; reported Aug 31; Duplicator 5.0.0 released Sep 8 2026 with patch. Second-order: attacker stores serialized object in a public comment; admin later builds a package and migrates; installer unserializes it. Update Free and Pro to 5.0.0 or newer.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2178,"url":"https://securityonline.info/duplicator-wordpress-plugin-php-object-injection/","title":"Duplicator WordPress Plugin Patched for RCE Flaw","kind":"blog","source":"analyst","text":"Free <=1.5.17 and Pro <=4.6.10 affected; 5.0.0 fixes via SnapUtil::safeUnserialize() with allowed_classes=false. Updating does not fix previously generated archives: rebuild packages with patched release before migrating.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2180,"url":"https://www.tenable.com/cve/CVE-2026-82814","title":"Tenable CVE-2026-82814","kind":"other","source":"analyst","text":"Vulnerable in DUPX_UpdateEngine::unserializeTest() during migration. Free bundles Requests 1.7 POP chain giving OS command execution; Pro bundles IndexList destructor gadget deleting a file (e.g. wp-config.php) leading to possible takeover. Package must be created after carrier is stored and an admin migration is required.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}