CVE-2026-115251
Received Received - Intake

Unauthenticated PHP Code Execution in Duplicator WordPress Plugin

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: WPScan

Description
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-115251
EUVD
EUVD-2026-109353

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Duplicator 1.5.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Duplicator WordPress plugin before version 5.0.0 has a vulnerability where its one-click upgrade feature does not restrict access to authorized users and is exposed without authentication. This allows an administrator of a multisite child site, who is not a network administrator, to install and run arbitrary PHP code in the network-wide shared plugin directory.

Detection Guidance

Check the installed version of the Duplicator plugin using WordPress admin dashboard or via command line with: wp plugin list --name=duplicator. If the version is below 5.0.0, the system is vulnerable.

Impact Analysis

An attacker with admin access to a subsite can exploit this to install malicious PHP code that affects the entire multisite network. This could lead to unauthorized code execution, data breaches, or complete network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations could face legal penalties and reputational damage.

Mitigation Strategies
  • Update the Duplicator plugin to version 5.0.0 or later immediately to patch the vulnerability.
  • Review user roles on multisite child sites to ensure only network administrators can install plugins.
  • Monitor for unauthorized PHP files in the shared Duplicator plugin directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart