Duplicator WordPress Plugin Patched for High-Severity PHP Object Injection Vulnerability
Do Son 
TL;DR
Wordfence researchers discovered an unauthenticated PHP Object Injection vulnerability (CVE-2026-82814) in the Duplicator WordPress plugin and Duplicator Pro. The flaw allows attackers to plant a dormant payload inside a public comment that triggers during a site migration, leading to command execution or site takeover. Administrators must update to version 5.0.0 or newer immediately and recreate older migration packages.
- CVE: CVE-2026-82814
- CVSS: 8.8 (High · CVSSv3)
- Product: smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
- Affected: ≤ 1.5.17, ≤ 4.6.10
- Impact: Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
- Status: No confirmed exploitation yet
- EPSS: 0.5% (30-day)
- Action: See vendor advisory
Why It Matters
The Duplicator WordPress plugin is a widely deployed backup and migration tool with more than one million active installations worldwide. Tracked as CVE-2026-82814, this flaw carries a high CVSS v3.1 base score of 8.8.
According to the Wordfence Threat Intelligence report, researchers found the bug on August 30, 2026, using their AI-assisted system, Wordfence Argus, during a WordPress 7.1 assessment led by Alex Thomas. Currently, no public proof-of-concept exploit code has been published, and no active exploitation in the wild has been confirmed.
How the Attack Works
CVE-2026-82814 is a second-order vulnerability. In its advisory, Wordfence explains that “An unauthenticated attacker can place a malicious value in an ordinary WordPress comment, where it remains dormant. If an administrator later creates a Duplicator package containing that comment and uses the package to migrate the site, the standalone installer treats the stored value as a PHP object and activates it.”
Unsafe Deserialization via Public Comments
First, an attacker submits a base64-encoded PHP object to wp-comments-post.php without needing an account. Even if comment moderation is active, WordPress saves pending comments in the database. Later, during a standard migration or import, the DUPX_UpdateEngine::unserializeTest() function decodes base64 strings and passes them to PHP’s native unserialize() function without restricting allowed classes.
Command Execution and Site Takeover
The impact differs between editions. In Duplicator Free, the installer pairs the DbUserMode class with an older Requests library iterator to pass attacker-controlled arguments to call_user_func(). Consequently, attackers can execute arbitrary operating-system commands as the web-server user.
In Duplicator Pro, attackers abuse the Duplicator\Libs\Index\IndexList destructor to delete arbitrary files. Wordfence notes that “deleting wp-config.php can reopen the WordPress setup process and lead to site takeover and PHP code execution when the attacker reaches the setup process first and supplies a reachable database they control.”
Affected Versions
This vulnerability affects Duplicator WordPress plugin (Free) versions up to and including 1.5.17, as well as Duplicator Pro versions up to and including 4.6.10, prior to the 5.0.0 release. Version 5.0.0 and newer releases are not affected.
Patch and Mitigation Steps
The vendor patched the flaw in version 5.0.0 by introducing SnapUtil::safeUnserialize(), which sets allowed_classes to false during deserialization. In its report, Wordfence states, “We urge users of both Duplicator Free and Duplicator Pro to update to version 5.0.0 or a newer version as soon as possible.” Because updating the plugin does not fix previously generated backup archives, administrators should generate fresh packages using the patched release before performing any site migrations.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
