Duplicator

CVE-2026-82814 is a high-severity, second-order PHP object injection vulnerability affecting Duplicator Free through version 1.5.17 and Duplicator Pro through version 4.6.10. Wordfence assigned a CVSS 3.1 score of 8.8 (High). More than one million WordPress sites use the free plugin.

The attacker does not need a WordPress account. However, exploitation is not immediate: attacker-controlled data must be stored before a Duplicator package is built, and an administrator must later use that package for a standard migration or import that performs database search-and-replace.

Affected Versions

• Duplicator Free: versions 1.5.17 and earlier.
• Duplicator Pro: versions 4.6.10 and earlier.
• Fixed version: 5.0.0 and later for both editions.
• Current WordPress.org release: 5.0.6 at the time of publication.

Exploit Path and Prerequisites

Affected installers pass untrusted database content to PHP deserialization during migration. Wordfence demonstrated that an anonymous WordPress comment can act as the stored carrier even when it remains pending moderation. The payload stays dormant while the comment is submitted and while the package is created.

1. An unauthenticated attacker stores crafted serialized data in site content.
2. An administrator creates a Duplicator package containing that data.
3. The administrator later runs the package as a standard migration or import.
4. The affected installer decodes and deserializes the stored value during database replacement.

In Duplicator Free, the affected installer included classes that Wordfence chained into operating-system command execution. In Duplicator Pro, a different bundled class enabled arbitrary file deletion. Under additional conditions, deleting wp-config.php could expose WordPress setup and permit site takeover.

Simply creating or storing a package does not trigger the vulnerability. Wordfence validated the trigger through standard migration/import processing, not Duplicator recovery or restore modes. Comment moderation alone is insufficient because pending comments are still stored in the database.

Immediate Remediation

1. Update Duplicator Free or Pro to 5.0.0 or later. Prefer the latest available release.
2. Before a migration or import, create a fresh package with the updated plugin. Old packages retain the installer code included when they were built.
3. Do not use an affected package for a standard migration. Rebuild it when practical.
4. Remove standalone installer files and package archives from publicly reachable web directories when they are no longer required.
5. Review pending and spam comments, plus any other public input stored before package creation. Deleting suspicious comments is useful hygiene but is not a substitute for updating.
6. Restrict migration operations to trusted administrators and use a maintenance window with access controls at the destination.

Patch Details

Duplicator 5.0.0 changed the migration engine to use a safe deserialization helper that calls PHP with allowed_classes disabled. This prevents attacker-named classes from being instantiated at the vulnerable migration point. Wordfence directly verified the fix in Duplicator Free 5.0.0 and confirmed the equivalent repaired implementation in Duplicator Pro.

Verification and Cleanup

Use these read-only WP-CLI checks to confirm the installed version and inspect stored packages and comments:

wp plugin get duplicator --fields=name,status,version,update,update_version
wp comment list --status=hold --fields=comment_ID,comment_author,comment_date,comment_post_ID
wp comment list --status=spam --fields=comment_ID,comment_author,comment_date,comment_post_ID
wp core verify-checksums
wp plugin verify-checksums duplicator

Inventory Duplicator-related archives and standalone installer files from the WordPress document root. Review the output before deleting anything:

find . -type f \( -name 'installer.php' -o -name 'installer-backup.php' -o -name '*_archive.zip' -o -name '*.daf' \) -print

Also review web-server access logs for unexpected requests to standalone Duplicator installer paths. If a vulnerable migration has already run, treat the destination as potentially compromised: preserve logs, inspect recently modified PHP files and administrator accounts, rotate credentials, and restore from a known-clean source when integrity cannot be established.

Temporary Mitigation

If an immediate update is impossible, do not run standard migrations or imports with packages created by affected releases. Temporarily disabling public comments can remove the demonstrated anonymous carrier, but other attacker-controlled database content may still reach the vulnerable engine. Updating and rebuilding migration packages remain the required fixes.

Sources

• Wordfence technical disclosure for CVE-2026-82814
• CVE record: CVE-2026-82814
• WordPress.org Duplicator plugin page

Featured image source: Wordfence disclosure.