CVE-2026-115251

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network...

EUVD-2026-109353

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network...

CVE-2026-115251

The Duplicator WordPress plugin (versions before 5.0.0 ) contains a vulnerability where its one-click upgrade routine is neither restricted to authorized users nor protected by authentication. This flaw allows an administrator of a multisite child site who lacks network administrator privileges t...

CVE-2026-115251 Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network...

Duplicator < 1.4.7.1 - Information Disclosure

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. id: CVE-2022-2552 info: name: Duplicator 1.4.7.1 - Information Disclosure author:...

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...

wordpress-snapcreek

wordpress-snapcreek snapcreekduplicator file read vulnerability https://www.cvedetails.com/cve/CVE-2020-11738/ Step1: Open MSFconsole: and use wordpressscanner to find all plugins used by target machine. STEP2: Attack using python script: Install/ upgrade pip3 on attacker machine Sudo apt install...

WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution. id: CVE-2018-17207 info: name:...

WordPress Duplicator Pro plugin <= 4.6.10 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Alex Thomas, Wordfence Argus in WordPress Plugin Duplicator Pro versions = 4.6.10...

WordPress Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More plugin <= 1.5.17 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Alex Thomas, Wordfence Argus in WordPress Plugin Duplicator versions = 1.5.17...

CVE-2026-82814

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

CVE-2026-82814

The Duplicator and Duplicator Pro plugins for WordPress (versions up to 1.5.17 and 4.6.10 , respectively) are vulnerable to unauthenticated PHP Object Injection . The root cause is the unsafe deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during a migration....

EUVD-2026-107032

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and...

PT-2026-120152

Name of the Vulnerable Software and Affected Versions Duplicator versions prior to 5.0.0 Duplicator Pro versions prior to 5.0.0 Description An unauthenticated PHP Object Injection exists due to the deserialization of untrusted database content within the unserializeTest function of the DUPX...

WordPress Post Duplicator plugin <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution vulnerability

Missing Authorization to Authenticated Contributor+ Post Duplication with Arbitrary Author Attribution vulnerability discovered by Abi Wiranata in WordPress Plugin Post Duplicator versions = 3.0.11...

CVE-2026-4244

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-4244

The Post Duplicator plugin for WordPress (all versions up to and including 3.0.11 ) is vulnerable to unauthorized data modification due to a missing capability check in the duplicate_post() function. The function does not verify that the caller holds the edit_others_posts capability before accept...

CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...