Duplicator has unauthenticated PHP object injection (CVE-2026-82814)
Original title: Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator
Builds through 1.5.17 and Pro 4.6.10 are fixed in 5.0.0; old packages keep the installer that created them.
On August 30, 2026, Wordfence found a second-order unauthenticated PHP object injection flaw in Duplicator and Duplicator Pro, CVE-2026-82814, CVSS 8.8. An attacker can store a malicious value in a WordPress comment; if an administrator later migrates a package containing it, the installer instantiates that value. Free can run an attacker-chosen operating-system command; Pro can delete a chosen file, which testing showed can lead to site takeover. The vendor patched the migration path in version 5.0.0.
- Duplicator has more than one million active installations.
- Wordfence disclosed the issue on August 31; version 5.0.0 shipped on September 8.
- Premium firewall coverage shipped October 15; free Wordfence users get it November 14.
- Pro testing showed deleting wp-config.php can reopen setup and enable code execution.
Impact: OS command execution or file deletion leading to site takeover
| Product | Affected | Fixed in |
|---|---|---|
| Duplicator | <= 1.5.17 | 5.0.0 |
| Duplicator Pro | <= 4.6.10 | 5.0.0 |
- 1.Update Duplicator Free and Duplicator Pro to version 5.0.0 or newer.
- 2.Create a fresh package with an updated version before migrating an older package.
- CVEs
- CVE-2026-82814
- Vendors
- Duplicator
- Products
- Duplicator ProWordfence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82814 | PHP object injection in Duplicator during migration | 8.8 | — |
From the original article
12 min read at wordfence.com
Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5. 0.
By Alex Thomas · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.