---
id: "CVE-2026-82814"
kind: "vulnerability"
aliases: ["CVE-2026-82814"]
title: "Duplicator WordPress plugins: unauthenticated PHP object injection leads to command execution"
severity: "high"
cvss: 8.8
epss: 0.0053
exploited: false
status: "open"
category: "package"
products: [{"name": "Duplicator", "fixed": ["5.0.0"], "affected": "<= 1.5.17", "ecosystem": "wordpress"}, {"name": "Duplicator Pro", "fixed": ["5.0.0"], "affected": "<= 4.6.10", "ecosystem": "wordpress"}]
ecosystems: ["wordpress"]
tags: ["duplicator", "duplicator-pro", "package", "php-object-injection", "self-hosted", "wordpress"]
not_affected_if: ["managed-hosting", "no-migration-performed", "plugin-not-installed"]
published_at: "2026-10-21T02:17:07+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82814", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:48:47+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-82814", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Duplicator WordPress plugins: unauthenticated PHP object injection leads to command execution

Duplicator (Free <=1.5.17, Pro <=4.6.10) unserializes database content in the standalone installer during migration. An unauthenticated attacker can plant a serialized object in public content such as a comment. It stays dormant until an admin builds a package and migrates. Free then gets OS command execution through a bundled Requests 1.7 POP chain. Pro gets deletion of an attacker-chosen file, and deleting wp-config.php can lead to takeover. CVSS 8.8.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:Duplicator affected <= 1.5.17 fixed 5.0.0
- wordpress:Duplicator Pro affected <= 4.6.10 fixed 5.0.0

## How to check

WordPress admin > Plugins: Duplicator Free <=1.5.17 or Duplicator Pro <=4.6.10 is vulnerable. Or run: wp plugin list --name=duplicator --fields=name,version. Packages and installers built on older versions stay vulnerable even after the plugin is updated. Whether a comment already carries a payload cannot be checked without a migration: unknown.

## Fix

Update Duplicator Free and Duplicator Pro to 5.0.0 or newer (5.0.6 is current for Free). Then rebuild any existing packages with the patched release before migrating or restoring. Do not use archives built on older versions.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82814
- 2026-10-23T23:48:47+00:00 analyst — Wordfence (primary researcher post), Tenable and securityonline agree: Free <=1.5.17 and Pro <=4.6.10 affected, fixed in 5.0.0 (released 2026-09-08). No in-the-wild exploitation or public PoC found. X posts were only restatements, none saved. NVD page returned empty; the Wordfence page text was truncated, so details come from search excerpts.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-82814

## Documents

- [advisory] Wordfence: Unauthenticated PHP Object Injection in Duplicator https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-high-severity-unauthenticated-php-object-injection-in-duplicator/
- [describes] Tenable CVE-2026-82814 https://www.tenable.com/cve/CVE-2026-82814
- [fix] Duplicator WordPress Plugin Patched for RCE Flaw https://securityonline.info/duplicator-wordpress-plugin-php-object-injection/

## From the sources

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_