The CVE record published by Wordfence on Oct 21 (UTC) describes PHP object injection in DUPX_UpdateEngine::unserializeTest() in Duplicator ≤ 1.5.17 and Duplicator Pro ≤ 4.6.10. An unauthenticated attacker stores a serialized object in public site content (for example a comment). If an admin builds a package afterwards and then runs a migration or import with database search-and-replace, the object is deserialized.

In Duplicator Free a bundled Requests 1.7 POP chain gives attacker-chosen callbacks and direct OS command execution. In Pro, a destructor gadget can delete an attacker-chosen file; deleting wp-config.php exposes the setup wizard, which can lead to takeover if the attacker reaches it first. CVSS 3.1 is 8.8 (user interaction required, since an admin must migrate).

Do now: update Duplicator/Duplicator Pro past the affected versions before your next migration, and before migrating, scan comments and other public content for serialized PHP strings (O: followed by a class name). See Wordfence entry.