CVE-2026-112244 in Duplicator Plugin
Summary
by MITRE • 11/04/2026
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in versions of the Duplicator WordPress plugin prior to 5.1.0 represents a critical information disclosure flaw stemming from improper access control mechanisms within bundled PHP files. The core issue lies in the failure to enforce context-aware initialization for specific internal scripts that are included by other parts of the application but remain directly accessible via HTTP requests when not properly secured. These files, which serve as dependencies or utility modules rather than standalone entry points, do not implement checks to verify whether they are being executed within the expected WordPress environment. Consequently, an unauthenticated attacker can craft a direct URL request targeting these specific PHP endpoints, bypassing standard authentication and routing layers that would normally restrict access to administrative functions or sensitive data processing logic.
When such a file is accessed directly without its required context, it attempts to execute initialization code that relies on global variables, database connections, or WordPress core functions that are not yet defined in the current execution scope. This mismatch between expected state and actual runtime environment triggers a fatal PHP error rather than handling the situation gracefully with an appropriate access denied response. The severity of this flaw is amplified by the default behavior of many web server configurations and PHP settings during development or debugging phases, where detailed stack traces are displayed to aid in troubleshooting. In this scenario, the resulting HTTP response includes a comprehensive stack trace that reveals the absolute filesystem paths on the underlying operating system where the WordPress installation resides.
This disclosure of absolute file paths provides attackers with valuable reconnaissance data essential for further exploitation attempts. Knowledge of the exact directory structure allows malicious actors to construct more precise attack vectors, such as local file inclusion attacks or path traversal exploits targeting specific configuration files like wp-config.php which often reside in known relative locations from the disclosed root path. Furthermore, this information aids in identifying the specific version of PHP and other server-side technologies running on the host, facilitating targeted exploit development against known vulnerabilities associated with those software versions. The flaw is categorized under CWE-209 as an Information Exposure Through an Error Message, highlighting the failure to sanitize error output before it reaches the client side.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1589.001, specifically Gather Victim Identity Information: Email Addresses, although in this context, it extends to gathering system identity and infrastructure details via file path enumeration. It also relates to CWE-200 where information is exposed through error conditions that should be suppressed or logged server-side only. The operational impact includes the potential for unauthorized access if combined with other vulnerabilities such as local file inclusion, leading to complete compromise of the web application and potentially the underlying host system depending on service permissions.
Mitigation strategies must focus on both immediate remediation and long-term security hardening. Administrators should immediately upgrade the Duplicator plugin to version 5.1.0 or later where this access control issue has been addressed by implementing proper context checks in all bundled PHP files. These checks typically involve verifying that specific WordPress constants are defined, ensuring the request originates from a valid admin nonce, or explicitly denying direct execution of utility scripts via HTTP methods other than POST if they require stateful data. Additionally, server-level configurations should be reviewed to ensure that display_errors is set to off in production environments, preventing stack traces from being rendered in HTML responses regardless of application code flaws. Implementing Web Application Firewalls can also provide a layer of defense by detecting and blocking requests targeting common plugin directories or suspicious parameter patterns associated with file inclusion attempts.