Duplicator vulnerability puts WordPress migrations at risk
The Duplicator vulnerability tracked as CVE-2026-82814 can turn an ordinary WordPress comment into malicious code that activates during a later site migration. Wordfence Threat Intelligence discovered the flaw on August 30, 2026, during a WordPress 7.1 security assessment assisted by its Argus research system. Duplicator has more than one million active installations. The issue has a Common Vulnerability Scoring System score of 8.8 out of 10, classified as High.
Affected releases are Duplicator Free through 1.5.17 and Duplicator Pro through 4.6.10. The defect is an unauthenticated PHP Object Injection, meaning someone without an account can supply stored data that PHP later turns into a software object with potentially dangerous behavior. It is also a second-order vulnerability: the attacker's initial request does not cause immediate harm. Execution depends on a later, legitimate action by an administrator.
The demonstrated route begins at WordPress's public wp-comments-post.php endpoint. An attacker can submit a comment without an account, cookie or nonce, which is a one-time check intended to confirm that a request is legitimate. The comment contains a malicious PHP object encoded with base64, a method for representing data as ordinary text. Approval is irrelevant because WordPress stores pending comments in its database. If an administrator subsequently creates a Duplicator package, the stored comment is copied into it.
The payload remains inactive while the package is created or stored. It runs only if an administrator uses that package for a standard migration or import that performs Duplicator's Update Data search-and-replace process. That process changes database values such as the old website address and filesystem path so that they match the destination. Serialized data, which stores values together with details such as string lengths and class names, needs special handling when those values change.
Affected installers pass possible serialized values to PHP's native unserialize() function through DUPX_UpdateEngine::unserializeTest() without preventing classes from being created. PHP can then invoke special methods such as __wakeup() and __destruct(). A useful sequence of such methods is called a gadget chain, and it can make attacker-controlled data perform actions never intended by the plugin developer. The migration engine also decodes database values that are entirely base64-encoded before testing them, allowing an encoded comment to reach the vulnerable function.
The consequences differ by edition. Duplicator Free 1.5.17 included Requests 1.7 in its generated installer. Wordfence combined Duplicator's DbUserMode class with Requests_Utility_FilteredIterator, whose current() method calls a callback selected from the serialized data. Because the attacker controls both the callback and its argument, a PHP function such as system() can run a chosen operating-system command. Wordfence verified direct command execution with the permissions of the account running the web server and also used the chain to delete a file.
Duplicator Pro 4.6.10 had a newer Requests library, so that callback chain was unavailable. Its installer nevertheless included Duplicator\Libs\Index\IndexList. The class's destructor deletes the file identified by its path property. Wordfence first confirmed deletion with test files and then deleted wp-config.php, the file containing a WordPress site's core database configuration, on a disposable installation. The file must exist, and the PHP process running the installer must be permitted to modify its directory.
Without wp-config.php, WordPress presents its normal setup process. Wordfence demonstrated that an attacker who reaches it before the owner can supply a reachable database under the attacker's control, create an administrator and install a proof-of-concept plugin to execute PHP code. This path does not expose the original site's database or credentials, but it can give the attacker control of WordPress on the affected domain and filesystem.
Several conditions limit the attack. The malicious database value must exist before the package is built, and an administrator must later start a standard migration or import that runs database replacement. Creating or merely retaining a backup does not activate it. Wordfence did not demonstrate the chain through Duplicator's restore or recovery modes. Disabling public comments removes the demonstrated delivery route, but Wordfence cautioned that other attacker-controlled database content might still reach the same vulnerable engine.
Duplicator 5.0.0 fixes the vulnerable migration path. Its SnapUtil::safeUnserialize() method calls unserialize() with allowed_classes set to false, preventing data from instantiating the named classes at this point. The returned value is used only to decide whether the input is valid and is then discarded. Duplicator Free 5.0.0 also stopped using the older Requests component involved in direct command execution. Wordfence verified the Free fix, reviewed Duplicator Pro 5.0.5 and found its relevant security files identical to the repaired Free implementation, while the developer confirmed that Pro 5.0.0 received the same fix.
Updating does not rewrite packages that already exist. An archive made by an affected version retains that version's installer. In testing, Duplicator Pro 5.0.5's normal Import workflow ran the older installer from a Pro 4.6.10 package and reached the vulnerable path. Its automatic Restore workflow forced restore mode, skipped the affected replacement process and did not trigger the flaw. Duplicator Free 5.0.0 declined to restore a Free 1.5.17 package automatically and instead directed the administrator to download and run its installer manually. Running that bundled installer as a standard migration can remain dangerous if the package contains a malicious value.
Wordfence disclosed the issue on August 31, and the developer acknowledged it on September 2. Version 5.0.0 was released on September 8, with confirmation of the patch on September 25. Wordfence completed its review on October 9. Its existing Generic Object Injection firewall protection already offered a degree of coverage to free and paid users. A more targeted rule reached Premium, Care and Response customers on October 15, with availability for free users scheduled for November 14, 2026. Firewall coverage is an additional layer, not a replacement for updating.
Site owners should update both editions to 5.0.0 or later, build a fresh package before a migration or import when practical, and remove standalone installer files that remain publicly accessible after they are no longer needed. For organisations that prefer not to manage WordPress infrastructure alone, AEU Hosting provides managed WordPress hosting secured end to end.