CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

PT-2026-120152

Name of the Vulnerable Software and Affected Versions Duplicator versions prior to 5.0.0 Duplicator Pro versions prior to 5.0.0 Description An unauthenticated PHP Object Injection exists due to the deserialization of untrusted database content within the unserializeTest function of the DUPX...