Unauthenticated PHP Object Injection in Duplicator Plugin Affects Over One Million WordPress Sites
A critical vulnerability in the popular Duplicator and Duplicator Pro WordPress plugins allows unauthenticated attackers to execute arbitrary commands or delete files, impacting over one million installations.
The Wordfence Threat Intelligence Team has discovered a high-severity PHP Object Injection vulnerability, tracked as CVE-2026-82814, affecting the widely-used Duplicator and Duplicator Pro WordPress plugins. With over one million active installations, this vulnerability poses a significant risk to websites relying on these popular backup and migration tools. The flaw, which carries a CVSS 3.1 score of 8.8, is a second-order vulnerability, meaning it requires a specific chain of events to be exploited.
Attackers can exploit this vulnerability by injecting malicious data into ordinary WordPress comments. This malicious data remains dormant until an administrator creates a Duplicator package that includes the compromised comment. When this package is later used to migrate the site, the standalone installer processes the stored value as a PHP object. This deserialization process triggers the vulnerability, leading to different consequences depending on whether the free or Pro version of Duplicator is in use.
In Duplicator Free, attackers can leverage bundled classes within the installer to execute arbitrary operating-system commands. This could allow an attacker to take full control of the server hosting the WordPress site. For Duplicator Pro users, a different built-in class enables the deletion of attacker-selected files. Wordfence demonstrated that by targeting critical files like wp-config.php, an attacker could potentially reopen the WordPress setup process, leading to a complete site takeover and arbitrary PHP code execution if they can control the database during the setup phase.
The vulnerability was identified using Wordfence's AI-assisted security research system, Wordfence Argus, during a security assessment. Argus helped trace the attacker-controlled data from its initial storage in comments through to the administrator-driven migration process, revealing the exploitation paths in both Duplicator editions. Wordfence emphasizes its commitment to enhancing WordPress security through proactive vulnerability research and vendor collaboration.
Wordfence reported the vulnerability to the Duplicator team on August 31, 2026, through their Vulnerability Management Portal. The developers acknowledged the report and released patches in Duplicator version 5.0.0 and Duplicator Pro version 4.6.10 on September 8, 2026. While updating the plugin is crucial, it does not automatically fix packages created with vulnerable versions. Administrators are advised to create fresh packages with updated versions before performing migrations using older package files.
The Wordfence Firewall's generic object injection protection offered some protection to all users, including those on the free version. However, to provide more specific defense, Wordfence released an additional, vulnerability-specific firewall rule for its Premium, Care, and Response customers on October 15, 2026. Users of the free Wordfence plugin will receive this enhanced protection on November 14, 2026.
Given the widespread use of Duplicator and the severity of the potential impact, users are strongly urged to update to the patched versions immediately to safeguard their websites against potential exploitation. The vulnerability highlights the ongoing risks associated with deserialization flaws in popular plugins and the importance of timely patching and robust security measures.