As cited
Copy frozen at (site build).
vulnerabilities
Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator
Wordfence discovered CVE-2026-82814, a high-severity unauthenticated PHP object injection vulnerability in Duplicator and Duplicator Pro affecting over one million installations. An attacker can inject a malicious serialized object into a WordPress comment, which activates when an administrator creates a backup package and performs a migration, leading to remote code execution in Duplicator Free or arbitrary file deletion in Duplicator Pro. The vulnerability has been patched in version 5.0.0 released September 8, 2026, and Wordfence deployed firewall rules on October 15, 2026 for paid users and November 14, 2026 for free users.
Why it matters: WordPress site administrators using Duplicator or Duplicator Pro must update immediately to version 5.0.0 or later and recreate backup packages with the patched version before performing migrations, as existing packages with vulnerable installers can still trigger exploitation during standard migrations or imports.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator
Wordfence discovered CVE-2026-82814, an unauthenticated PHP object injection vulnerability in Duplicator and Duplicator Pro (versions 1.5.17 and 4.6.10 and earlier) affecting over one million installations. An unauthenticated attacker can store a malicious serialized object in a WordPress comment, which activates when an administrator creates a migration package and performs a standard migration, leading to operating-system command execution in Duplicator Free or arbitrary file deletion in Duplicator Pro. The Duplicator team released version 5.0.0 on September 8, 2026, patching the unsafe deserialization during migration; Wordfence released additional firewall rules on October 15, 2026, for premium users and November 14, 2026, for free users.
Why it matters: WordPress site administrators running Duplicator or Duplicator Pro must update to version 5.0.0 or later immediately, and should create fresh migration packages with the updated version before performing any migrations, as older packages retain vulnerable installers.
- Source published
- First seen by Cybersecurity Tracker