CVE-2026-115251
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install plugins and exposes the routine without authentication. This allows an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory.
Risk Assessment
A low-privileged user can execute arbitrary PHP in the context of the entire multisite network, potentially leading to full WordPress compromise.
Recommendation
Update the Duplicator plugin to version 5.0.0 or later. Restrict privileges of child site administrators in multisite.
Other vulnerabilities in Duplicator WordPress plugin
See all- CVE-2026-115262Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict their database charset and collation rewrite to schema statements during a restore. A value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
- CVE-2026-112244Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not prevent direct access to some bundled PHP files, which initialize without their expected context, trigger a fatal error, and return a stack trace disclosing the server's absolute filesystem paths to unauthenticated users.
- CVE-2026-112243Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not sanitize and escape a parameter before reflecting it on one of their administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
Original NVD description (English source)
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS