CVE-2026-82814

Deferred Deferred - Pending Action

PHP Object Injection in Duplicator WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: Wordfence

Description

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-82814

EUVD

EUVD-2026-107032

Affected Vendors & Products

Vendor	Product	Version / Range
smub	Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More	0
Duplicator	Duplicator Pro	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

The Duplicator and Duplicator Pro WordPress plugins have a PHP Object Injection vulnerability in versions up to 1.5.17 and 4.6.10 respectively. Attackers can exploit this by storing a malicious serialized object in public site content. When an administrator performs a migration or import, the plugin deserializes this data, leading to potential command execution or file deletion. The Free version includes a POP chain enabling OS command execution, while the Pro version allows deletion of files like wp-config.php, which could lead to site takeover.

Detection Guidance

Check for unauthorized file deletions or modifications in WordPress directories, especially wp-config.php. Review Duplicator plugin logs for suspicious migration or import activities. Inspect serialized data in public site content that may contain attacker-controlled objects.

Impact Analysis

An attacker could execute arbitrary operating system commands on your server if using Duplicator Free. For Duplicator Pro, they could delete critical files like wp-config.php, exposing the setup wizard and potentially allowing them to take over your site if they provide a controlled database. Both scenarios require an administrator to perform a migration or import after the attacker stores the malicious payload.

Compliance Impact

This vulnerability could lead to unauthorized code execution or file deletion, potentially compromising sensitive data. If exploited, it may result in data breaches, unauthorized access, or loss of critical configuration files, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Update Duplicator and Duplicator Pro to the latest versions beyond 1.5.17 and 4.6.10 immediately. Remove the vulnerable plugin if updates are unavailable. Audit and restore any deleted files, particularly wp-config.php. Monitor for unauthorized access or code execution attempts.

Hi! I’m here to help you understand CVE-2026-82814. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...