Loading story…
Wordfence disclosed CVE-2026-82814, a high-severity unauthenticated PHP object injection vulnerability in the Duplicator WordPress migration plugin, rated CVSS 8.8. The flaw affects Duplicator Free through version 1.5.17 and Duplicator Pro through version 4.6.10. Attackers can plant malicious serialized objects in public WordPress comments, including unapproved comments. The payload is triggered only after an administrator includes the comment in a package and performs a standard migration or import. Exploitation permits direct operating-system command execution in Free, while Pro allows arbitrary file deletion that can enable site takeover and PHP execution under additional conditions.
Version 5.0.0 fixes both editions by preventing attacker-specified classes from being instantiated during deserialization. However, updating the installed plugin does not repair vulnerable installers bundled into existing packages, leaving subsequent migrations using those packages exposed. Administrators should update both editions, generate fresh packages before migrations where practical, and remove unnecessary publicly accessible standalone installers.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
Wordfence found that Pro 5.0.5's normal Import workflow ran the vulnerable installer bundled in a Pro 4.6.10 package, while automatic Restore skipped the vulnerable operation. Free 5.0.0 refused automatic restoration of an older package and directed administrators to its bundled installer, which could still trigger the flaw during standard migration.
Wordfence detailed how unauthenticated attackers could plant serialized objects in public comments, including pending comments, for activation during a later administrator-run migration or import. Researchers demonstrated direct command execution in Duplicator Free and file deletion leading to site takeover and PHP execution in Duplicator Pro on a disposable installation.
Wordfence released an additional rule targeting CVE-2026-82814 to paid-tier users. Its existing Generic Object Injection protection had provided partial coverage.
Wordfence completed its patch review after directly verifying Duplicator Free 5.0.0 and confirming matching repaired security files in Pro 5.0.5. The vendor also confirmed that Pro 5.0.0 received the same fix.
The vendor confirmed that version 5.0.0 fixed the reported migration-time deserialization issue.
Duplicator released version 5.0.0, replacing the vulnerable migration deserialization path with safe deserialization that prevents attacker-specified classes from being instantiated. The Free edition also replaced the older Requests component used in the demonstrated command-execution chain.
The Duplicator team acknowledged receipt of the migration-time PHP object injection report.
Wordfence validated the vulnerability and privately disclosed its findings to the Duplicator team.
The Wordfence Threat Intelligence Team discovered CVE-2026-82814 using Wordfence Argus during a WordPress 7.1 security assessment. The high-severity vulnerability affects Duplicator Free through 1.5.17 and Duplicator Pro through 4.6.10.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcemalware.news
Open sourcewordfence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity unauthenticated second-order SQL injection flaw, **CVE-2026-19949** (CVSS 8.8), affects the All-in-One WP Migration and Backup WordPress plugin through version 7.109, exposing roughly 5 million sites. Attackers can plant malicious data through unauthenticated WordPress trackbacks; the payload is triggered only if an administrator later exports and restores the affected site using the plugin, where faulty regular-expression handling converts stored comment data into executable SQL. Successful exploitation can expose the plugin's `ai1wm_secret_key`, allowing an attacker to invoke its unauthenticated import action with a crafted `.wpress` archive. That archive can install a malicious must-use plugin and yield remote code execution, potentially resulting in complete site compromise. ServMask addressed the flaw in version 7.110; Wordfence released a firewall rule to paid customers and scheduled free-tier coverage for September 15.
Sep 4, 2026
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 18, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Apr 1, 2026