TI-2026-84963 Aliases CVE-2026-115262 GHSA-8p5f-q54f-ww8c

SQL injection in Duplicator restore via charset and collation

LOW 21CWE-89Published 2026-11-04 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: SQL injection
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

The Duplicator WordPress plugin before 5.1.0 and the duplicator-pro WordPress plugin from 5.0.0 before 5.1.0 are affected. The restore process does not limit its database charset and collation rewrite to schema statements (CWE-89). A Subscriber can store a crafted value in their own profile that breaks out of its string literal and injects SQL into the restore INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations. The references link to an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00184 8th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Duplicator (Unknown): 5.1.0duplicator-pro (Unknown): 5.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Duplicator	before 5.1.0	5.1.0	Patch available	CNA
Unknown	duplicator-pro	5.0.0 to before 5.1.0	5.1.0	Patch available	CNA

Duplicator VendorUnknown Affected before 5.1.0 Fixed in 5.1.0 Patch available CNA
duplicator-pro VendorUnknown Affected 5.0.0 to before 5.1.0 Fixed in 5.1.0 Patch available CNA

Remediation

Update Duplicator and duplicator-pro to version 5.1.0, the fixed version listed for both products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA Duplicator (Unknown) Fixed in 5.1.0
Fix · CNA duplicator-pro (Unknown) Fixed in 5.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-11-04
Duplicator, duplicator-pro 5.1.0
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-84956 Full path disclosure in Duplicator WordPress plugin installer filesPriority LOW 30
- TI-2026-84955 Reflected cross-site scripting in Duplicator WordPress pluginPriority LOW 25
Show all 3 records →

Timeline

2026-11-04 Threatist record created from CVE-2026-115262
2026-11-04 Alias added: GHSA-8p5f-q54f-ww8c
2026-11-04 CVSS score added · CISA ADP
2026-11-04 Weakness changed · CISA ADP
2026-11-04 CISA SSVC decision points changed

References

Exploit 1

https://wpscan.com/vulnerability/5359cd4c-9867-4b33-b0b2-ca85819f9af4/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences