Loading vulnerability…
Migration-time PHP object injection in WordPress Duplicator and Duplicator Pro
CVE-2026-82814 is an unauthenticated PHP object injection vulnerability affecting WordPress Duplicator Free through 1.5.17 and Duplicator Pro through 4.6.10. During migration, DUPX_UpdateEngine::unserializeTest() deserializes untrusted database values without restricting object classes. The migration engine also decodes entirely base64-encoded values before checking for serialized data. Attackers can plant serialized objects in public site content, including unapproved comments, for inclusion in a subsequently created package. Deserialization occurs when an administrator later migrates or imports that package and runs the Update Data database search-and-replace operation. Duplicator Free's bundled Requests 1.7 gadget chain enables direct operating-system command execution; Duplicator Pro's IndexList destructor gadget enables conditional arbitrary file deletion and subsequent site takeover under additional conditions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Duplicator Free permits operating-system command execution as the web-server user, potentially compromising the confidentiality, integrity, and availability of resources accessible to that account. Duplicator Pro permits deletion of an attacker-selected existing file when the installer PHP process can modify its containing directory. Deleting the WordPress configuration file can expose the setup wizard, enabling an attacker to redirect the installation to an attacker-controlled database, create an administrator account, and achieve PHP execution. This Pro takeover does not itself disclose the original database or its credentials. The vulnerability has a CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
If you can’t patch tonight, do this now.
Avoid migrating or importing potentially attacker-contaminated packages with affected installers. Disable public comments to remove the demonstrated unauthenticated payload carrier, but do not treat this as a complete workaround: other attacker-controlled database content may reach the same deserialization path, and pending comments already stored remain relevant. Restrict access to migration installers and the WordPress setup wizard, and remove unnecessary publicly accessible standalone installers. Wordfence Generic Object Injection protection provides partial coverage; a vulnerability-specific rule became available to paid users on October 15, 2026, with free-tier availability scheduled for November 14, 2026.
Patch, then assume compromise.
Update both Duplicator Free and Duplicator Pro to version 5.0.0 or later, which is identified as fixing the vulnerable migration path. The repaired engine uses SnapUtil::safeUnserialize() with allowed_classes set to false; Free 5.0.0 also replaces the older Requests component used by the demonstrated command-execution chain. Rebuild migration packages using a fixed release before migration or import wherever practical. Updating the installed plugin does not repair installers embedded in existing packages, and importing an older package can still execute its vulnerable installer. Remove identified malicious serialized content from the database before creating replacement packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.