Wordfence researchers found an unauthenticated PHP object injection flaw in the Duplicator WordPress plugin and in Duplicator Pro. The flaw is tracked as CVE-2026-82814 and scored 8.8 under CVSSv3. What makes it worth studying is the delay. The attacker plants a value that does nothing until an administrator performs a routine migration.
The two-stage mechanism
The advisory describes a second-order vulnerability. An unauthenticated attacker places a malicious value in an ordinary WordPress comment, where it remains dormant. If an administrator later creates a Duplicator package containing that comment and uses the package to migrate the site, the standalone installer treats the stored value as a PHP object and activates it.
The first stage is a form submission. An attacker posts a base64-encoded PHP object to wp-comments-post.php without needing an account. Moderation does not help, because WordPress stores pending comments in the database, and the value sits in the same table either way.
The second stage is deserialisation during migration. The DUPX_UpdateEngine::unserializeTest() function decodes base64 strings and passes them to PHP's native unserialize() without restricting allowed classes. That missing control turns stored text into a live object.
Wordfence researchers found the bug on 30 August 2026 using their AI-assisted system, Wordfence Argus, during a WordPress 7.1 assessment. No public proof-of-concept exploit code has been published and no active exploitation has been confirmed.
The two impacts, split by edition
The path after deserialisation differs between the free and paid editions, and that difference is operationally significant because the response differs too.
In Duplicator Free, the installer pairs the DbUserMode class with an older Requests library iterator to pass attacker-controlled arguments to call_user_func(). The result is arbitrary operating-system command execution as the web-server user.
In Duplicator Pro, attackers abuse the Duplicator\Libs\Index\IndexList destructor to delete arbitrary files. Wordfence notes the specific consequence: deleting wp-config.php reopens the WordPress setup process, which can lead to site takeover and PHP code execution if the attacker reaches the setup process first and supplies a database they control.
Command execution is immediate. File deletion that reopens an installer is quieter and hands the attacker a second opportunity later.
Affected versions and the fix
Duplicator Free up to and including 1.5.17 is affected. Duplicator Pro up to and including 4.6.10 is affected. Both are fixed in 5.0.0 and later. The plugin reports more than one million active installations.
The vendor fix is specific: version 5.0.0 introduced SnapUtil::safeUnserialize(), which sets allowed_classes to false during deserialisation. That is the correct shape of the control, because it constrains which classes the parser may instantiate rather than trying to filter input strings.
The step that updating does not cover
Updating the plugin does not fix backup archives that were generated before the patch. If a package was created while a malicious comment was in the database, the payload travels inside the archive. Wordfence advises generating fresh packages with the patched release before performing any site migrations.
That advice implies a review step many site owners will skip. If a migration was performed in the recent past using an older package, the question is not whether the plugin is now patched but whether the installer that ran was the vulnerable one. The reporting does not state how long the dormant value persists before a migration picks it up, which means the exposure window is bounded only by archive retention.
Checks for a site running Duplicator
- 1.
Confirm the plugin version. Anything below 5.0.0 is in range, and a pending update notice is not evidence of the installed version.
- 2.
List backup archives with their creation dates. Any archive created before the upgrade to 5.0.0 should be treated as untrusted and replaced rather than reused.
- 3.
If a migration ran on an older archive, look for consequences of both impacts: unexpected processes spawned by the web-server user, missing
wp-config.php, and a setup wizard that became reachable again. - 4.
Review the comment table for values that do not look like prose, especially base64-shaped strings. Deletion is not sufficient on its own, because the value may already be inside an archive, but it prevents the next package from carrying it.
What the reporting does not establish
The reporting does not state whether the pending-comment path requires the site to accept comments at all, does not quantify how many installations were exposed, and does not describe whether any Duplicator archive in the wild has been used as a delivery container. The EPSS figure quoted is 0.5% for 30 days, which is a forecast rather than an observation. Site owners should treat the archive question as open until their own inventory answers it.
References
SecurityOnline, "Duplicator WordPress Plugin Patched for High-Severity PHP Object Injection Vulnerability", 22 October 2026: https://securityonline.info/duplicator-wordpress-plugin-php-object-injection/
Wordfence Threat Intelligence report on CVE-2026-82814 referenced in the reporting (discovery 30 August 2026).