Back exploit-intel.com

CVE-2026-115251: Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade Exploit Intelligence - Recent CVEs / 24min The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary P

exploit-intel.com • October 25, 2026

Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.

Affected products and versions

Default status: unaffected

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-115251: Critical PHP Code Execution Vulnerability in Duplicator Plugin A critical vulnerability (CVE-2026-115251) has been identified in the Duplicator WordPress plugin prior to version 5.0.0. This flaw allows unauthorized multisite child site administrators to execute arbitrary PHP code in the shared plugin directory due to improper access controls and lack of authentication. The vulnerability affects all multisite installations using the Duplicator plugin before the patched version. As of now, there is no evidence of public proof-of-concept or. Users are advised to upgrade to version 5.0.0 or later and enforce strict access controls. The vulnerability was disclosed on October 25, 2026, with a patch available immediately. 1 sources 58

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)