CVE-2026-115251 in Duplicator Plugin
Summary
by MITRE • 10/25/2026
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in versions of the Duplicator WordPress plugin prior to version 5.0.0 represents a critical failure in access control logic, specifically involving privilege escalation and authentication bypass mechanisms within multisite environments. The core technical flaw lies in the implementation of the one-click upgrade routine, which fails to enforce appropriate role-based permissions checks before allowing execution. In a standard single-site WordPress installation, this might result in unauthorized plugin updates by low-privileged users; however, in a WordPress Multisite network configuration, the implications are significantly more severe due to the shared nature of certain directories and resources across all sites within the network.
The operational impact is driven by two distinct but related deficiencies: insufficient authentication requirements and inadequate authorization checks. First, the upgrade routine exposes its execution endpoint without requiring valid session credentials or nonces in some contexts, effectively allowing unauthenticated actors to trigger code execution if they can guess or discover the specific action URL. Second, even when authenticated, the plugin does not verify whether the current user possesses network-wide administrative privileges before proceeding with an operation that affects shared infrastructure. This allows a subscriber or contributor on a child site within a multisite setup to invoke functions intended exclusively for super administrators who manage the entire network.
By exploiting this flaw, an attacker can achieve arbitrary PHP code execution in the context of the web server process running the Duplicator plugin files. Since WordPress Multisite installations often share common directories such as wp-content/plugins across all sites, a successful exploit by a low-privileged user on any child site results in code injection into the globally accessible plugin directory. This effectively grants the attacker full control over the PHP environment for that specific component, which can be leveraged to read sensitive configuration files, exfiltrate database credentials stored in wp-config.php, modify core WordPress files, or install persistent backdoors across all sites hosted on the network.
From a classification perspective, this vulnerability aligns with CWE-269: Improper Privilege Management and CWE-306: Missing Authentication for Critical Function. The attack vector is consistent with MITRE ATT&CK technique T1505.003: Web Shell, as it allows an attacker to place executable code on the server through a legitimate administrative feature abused by unauthorized users. Furthermore, because the vulnerability relies on misconfigured access controls rather than input validation errors in parsing logic, it also touches upon CWE-862: Missing Authorization and CWE-915: Improper Control of Dynamically-Identified Variables if the upgrade routine improperly handles file paths or execution contexts during the update process.
Mitigation strategies must prioritize immediate remediation through version updates. Administrators running WordPress Multisite environments should upgrade Duplicator to version 5.0.0 or later, where these access control checks have been corrected to ensure that only users with explicit network-administrator privileges can trigger plugin upgrades and execute related routines. Until the update is applied, administrators should restrict public exposure of administrative endpoints using web application firewalls or server-level configuration rules, disable file editing capabilities within WordPress by setting WP_ALLOW_FILE_EDIT to false in wp-config.php, and regularly audit user roles to ensure that no low-privileged users have been granted unnecessary access to plugin management features. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of any potential code injection attempts by restricting script execution sources.