Duplicator: critical unauthenticated vulnerability, update to 5.0.0+ now

Wordfence has disclosed a high-severity vulnerability in Duplicator and Duplicator Pro, the WordPress backup and migration plugins used by hosting providers to relocate sites between servers. Anyone running this plugin on client sites must update immediately: the flaw requires no authentication.

What the advisory says

On 30 August 2026, during an internal security review, the Wordfence Threat Intelligence Team discovered an unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has over one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High).

The particularity lies in the attack mechanism: it's a second-order vulnerability. An unauthenticated attacker can inject a malicious value into a normal WordPress comment, where it lies dormant. If an administrator later creates a Duplicator package containing that comment and uses it to migrate the site, the standalone installer treats the stored value as a PHP object and instantiates it.

The consequences vary depending on which edition is installed. In Duplicator Free, the classes included in the affected installer can be combined to execute arbitrary commands on the operating system. In Duplicator Pro, a different built-in class allows the attacker to delete a file of their choosing. Wordfence has demonstrated that deleting wp-config.php can reopen WordPress's setup process and lead to site takeover and PHP code execution if the attacker reaches the setup first and provides a database under their control.

What to do

Wordfence's recommendation is to update to Duplicator version 5.0.0 or later. On the official wordpress.org repository, the latest available version is currently 5.0.6, with minimum requirements of PHP 7.4 and WordPress 5.3. Hosting providers managing multiple client sites should verify the installed version from the plugins panel before proceeding with any scheduled migration or backup operations, because the package creation process itself triggers the exploit on a site already compromised by a malicious comment.

Those unable to update immediately should at least suspend creating new Duplicator packages on sites with unmoderated public comments until the update is applied.