Skip to content
High Severity PHP Object Injection Vulnerability in Duplicator Plugin Discovered

High Severity PHP Object Injection Vulnerability in Duplicator Plugin Discovered

First seen 23 Oct 2026, 20:43 UTC • • •Early signal · one source
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 22:13 UTC
  • •CVE-2026-82814 is a high severity vulnerability with a CVSS score of 8.8.
  • •The vulnerability affects over one million installations of Duplicator and Duplicator Pro.
  • •A patch was released on September 8, 2026, with additional rules for enhanced protection on October 15.

On August 30, 2026, Wordfence discovered a high severity unauthenticated PHP Object Injection vulnerability in the Duplicator and Duplicator Pro plugins, tracked as CVE-2026-82814, with a CVSS score of 8.8. This vulnerability affects over one million active installations of Duplicator, allowing unauthenticated attackers to inject malicious values that can be activated during site migrations. In Duplicator Free, attackers can execute OS commands, while in Duplicator Pro, they can delete files like wp-config.php, potentially leading to site takeover. Wordfence disclosed the vulnerability to the Duplicator team on August 31, 2026, and a patch was released on September 8, 2026. The Wordfence Firewall provided some protection prior to the patch, and additional rules were released on October 15, 2026, to enhance security for premium users.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-30
Vulnerability discovered
Wordfence identified a high severity unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro.
Wordfence
2026-08-31
Vulnerability disclosed to Duplicator team
Wordfence provided full disclosure details to the Duplicator team through their Vulnerability Management Portal.
Wordfence
2026-09-02
Acknowledgment of report
The Duplicator team acknowledged the vulnerability report from Wordfence.
Wordfence
2026-09-08
Patch released
Duplicator version 5.0.0 was released, containing the patch for the vulnerability.
Wordfence
2026-09-25
Confirmation of patch
The Duplicator team confirmed that version 5.0.0 contained the patch for the vulnerability.
Wordfence
2026-10-15
Additional firewall rules released
Wordfence released a vulnerability-specific firewall rule for premium users to enhance protection against the vulnerability.
Wordfence
2026-10-21
CVE-2026-82814 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (1)

Following this threat?

Track CVE-2026-82814 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

Which versions of Duplicator are affected?
The vulnerability affects both Duplicator and Duplicator Pro plugins, which have over one million active installations.
What should I do if I use Duplicator?
Update to Duplicator version 5.0.0 or later to ensure the vulnerability is patched.
Is there ongoing exploitation of this vulnerability?
No confirmed exploitation has been reported, but the vulnerability was disclosed and patched.