TI-2026-78567 Aliases CVE-2026-82814

PHP object injection in Duplicator and Duplicator Pro plugins

MEDIUM 41CWE-502Published 2026-10-21 · Updated 2026-10-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

The Duplicator and Duplicator Pro WordPress plugins are affected up to and including 1.5.17 and 4.6.10, respectively. Deserialization of untrusted database content in the migration update engine (CWE-502) lets an unauthenticated attacker store a serialized object in public site content. After an administrator builds a package and runs a migration or import, the stored object is deserialized, enabling command execution in Duplicator Free or deletion of an attacker-selected file in Duplicator Pro.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00733 54th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
smub	Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More	up to 1.5.17	—	No fix listed	CNA
Duplicator	Duplicator Pro	up to 4.6.10	—	No fix listed	CNA

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More Vendorsmub Affected up to 1.5.17 Fixed in — No fix listed CNA
Duplicator Pro VendorDuplicator Affected up to 4.6.10 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Duplicator (Backups & Migration Plugin, Cloud Backups, Scheduled Backups, & More) or for Duplicator Pro.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-21 Threatist record created from CVE-2026-82814
2026-10-22 Priority changed: MEDIUM → LOW
2026-10-22 CISA SSVC decision points changed
2026-10-22 Priority changed: LOW → MEDIUM
2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 3

TI-2026-07755 WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost CVSS 3.1HIGH 8.8
TI-2026-83530 Remote code execution in NextGEN Gallery plugin for WordPress CVSS 3.1HIGH 8.8
TI-2026-01649 ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation CVSS 3.1HIGH 8.8
TI-2026-01160 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion CVSS 3.1HIGH 8.8
TI-2025-12465 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated… CVSS 3.1HIGH 8.8
TI-2026-01650 Improper privilege management in smub ExactMetrics – Google Analytics Dashboard for… CVSS 3.1HIGH 8.8

See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences