Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-82814— Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

Quick assessment

Affected
smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Duplicator 和 Duplicator Pro 插件在所有版本（分别截至并包括 1.5.17 和 4.6.10）中均存在 PHP 对象注入漏洞。该漏洞源于在迁移过程中， 方法对不可信的数据库内容进行了反序列化。未认证的攻击者可在管理员创建备份包之前，将恶意序列化的对象存储于站点的公开内容中；随后，当管理员执行迁移或导入操作并触发数据库搜索与替换时，该恶意对象将被反序列化。 Duplicator 免费版捆绑了基于 Requests 1.7 的 PHP 对象注入（POP）链，允许攻击者选

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82814

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
Source: CVE Program / CVE List V5
Vulnerability Description
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More 0 ~ 1.5.17 -
Duplicator Duplicator Pro 0 ~ 4.6.10 -

II. Public POCs for CVE-2026-82814

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82814

请登录查看更多情报信息。

Vendor Pages for CVE-2026-82814 (2)

IV. Related Vulnerabilities

Same product: Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
Same vendor: smub
Same weakness: CWE-502

V. Comments for CVE-2026-82814

No comments yet

Leave a comment