CVE-2026-82814 with a CVSS score of 8.8 is a high-severity unauthenticated PHP object injection vulnerability in the Duplicator WordPress plugin and Duplicator Pro, affecting Duplicator WordPress plugin (Free) versions ≤ 1.5.17 and Duplicator Pro versions ≤ 4.6.10. The flaw is unsafe deserialization in the migration and backup component, where stored comment data can be processed as a PHP object during site migration. An unauthenticated attacker can submit a base64-encoded PHP object to wp-comments-post.php without an account, leaving it dormant in a comment even if moderation is active. If an administrator later creates a Duplicator package containing that comment and uses the package to migrate the site, the standalone installer decodes the value and passes it to PHP’s native unserialize function without restricting allowed classes. In the free edition, this can execute arbitrary operating-system commands as the web-server user. In Duplicator Pro, it can delete arbitrary files, and deleting wp-config.php can reopen the WordPress setup process, enabling site takeover and PHP code execution when the attacker reaches setup first and supplies a reachable database they control. The business impact is severe compromise of WordPress sites, including loss of confidentiality, integrity, and availability, unauthorized administration, and disruption of backup or migration operations.
We recommend you to update Duplicator WordPress plugin and Duplicator Pro to version 5.0.0.[/subscribe_to_unlock_form]
CVE-2026-82814 with a CVSS score of 8.8 is a high-severity unauthenticated PHP object injection vulnerability in the Duplicator WordPress plugin and Duplicator Pro, affecting Duplicator WordPress plugin (Free) versions ≤ 1.5.17 and Duplicator Pro versions ≤ 4.6.10. The flaw is unsafe deserialization in the migration and backup component, where stored comment data can be processed as a PHP object during site migration. An unauthenticated attacker can submit a base64-encoded PHP object to wp-comments-post.php without an account, leaving it dormant in a comment even if moderation is active. If an administrator later creates a Duplicator package containing that comment and uses the package to migrate the site, the standalone installer decodes the value and passes it to PHP’s native unserialize function without restricting allowed classes. In the free edition, this can execute arbitrary operating-system commands as the web-server user. In Duplicator Pro, it can delete arbitrary files, and deleting wp-config.php can reopen the WordPress setup process, enabling site takeover and PHP code execution when the attacker reaches setup first and supplies a reachable database they control. The business impact is severe compromise of WordPress sites, including loss of confidentiality, integrity, and availability, unauthorized administration, and disruption of backup or migration operations.
We recommend you to update Duplicator WordPress plugin and Duplicator Pro to version 5.0.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]