Advisory · CVE-2026-82814
Duplicator PHP object injection during migration can give command execution or site takeover
Duplicator and Duplicator Pro for WordPress, in versions up to and including 1.5.17 and 4.6.10, deserialize untrusted database content during migration, letting a stored serialized object reach command execution in the free plugin or file deletion and possible takeover in Pro. CVSS 3.1 8.8.
- Vendor
- Duplicator
- Product
- Duplicator and Duplicator Pro
- Identifier / CWE
- CVE-2026-82814
CWE-502 - Action timing
- Immediate
Explain it like I’m five
An attacker can hide a rigged serialized object in public site content, and when an admin later runs a Duplicator migration, the plugin unserializes that object and the rigged gadget fires.
- 01Carrier stored in site content
An unauthenticated attacker stores a serialized object in public site content on a site running an affected Duplicator version.
- 02Admin builds a package
An administrator creates a Duplicator package after the carrier is stored, carrying the poisoned database content into the migration.
- 03Migration runs search and replace
The administrator performs a migration or import that runs database search-and-replace through DUPX_UpdateEngine.
- 04Untrusted content unserialized
The unserializeTest path deserializes the untrusted database content and the stored gadget chain triggers.
- 05Commands run or files deleted
Per the record, the free plugin bundled Requests POP chain can give direct operating system command execution, while the Pro gadget can delete an attacker-selected file such as wp-config.php, exposing the setup wizard toward site takeover.
What happened
Wordfence disclosed CVE-2026-82814: the Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP object injection (CWE-502) in all versions up to and including 1.5.17 and 4.6.10 respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. Unauthenticated attackers can store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. The CVSS 3.1 score is 8.8, with network attack vector, low complexity, no privileges, and user interaction in the form of the administrator migration action required.
Per the record, Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. No fixed version is claimed here beyond the affected ranges in the record; the vendor changelog linked above is the update reference.
What to do
- Inventory WordPress sites running Duplicator or Duplicator Pro and note the version of each, including staging and migration target sites.
- Update the plugin in line with the vendor changelog for CVE-2026-82814; confirm your version against the affected ranges in the record rather than assuming an update applied.
- Do not run Duplicator migrations or imports from affected versions until updated, especially on packages built from sites with public user content.
- Hunt for serialized objects stored in public content such as comments and form entries, unexpected administrator migrations, missing wp-config.php files, and new database connections or admin users after a migration.
- Verify the deployed plugin version after updating on both source and target sites.
Management note
Backup and migration plugins run with full site trust and are usually touched only during moves, which is exactly when this flaw fires. Update Duplicator before the next migration, not after, and treat any migration already run on an affected version as a site integrity check.