---
title: WordPress Duplicator and Duplicator Pro: unauthenticated PHP object injection CVE-2026-82814 (CVSS 8.8) fires during migration and can lead to command execution | ctxsec
url: https://ctxsec.com/items/duplicator-cve-2026-82814-object-injection
description: "Duplicator up to 1.5.17 and Duplicator Pro up to 4.6.10 deserialize untrusted database content during migration search-and-replace. An unauthenticated attacker plants a serialized object in public content; when an admin later packages and migrates the site, Duplicator Free's bundled Requests 1.7 gadget runs OS commands, and Pro's gadget can delete wp-config.php."
status: "confirmed (Wordfence CNA CVE record); no exploitation reported"
published: 2026-10-20
---

> Duplicator up to 1.5.17 and Duplicator Pro up to 4.6.10 deserialize untrusted database content during migration search-and-replace. An unauthenticated attacker plants a serialized object in public content; when an admin later packages and migrates the site, Duplicator Free's bundled Requests 1.7 gadget runs OS commands, and Pro's gadget can delete wp-config.php.

[← Cybersecurity News](/news) · [markdown](/items/duplicator-cve-2026-82814-object-injection.md)

confirmed (Wordfence CNA CVE record); no exploitation reported

2026-10-20

### WordPress Duplicator and Duplicator Pro: unauthenticated PHP object injection CVE-2026-82814 (CVSS 8.8) fires during migration and can lead to command execution

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-82814) published by Wordfence on Oct 21 (UTC) describes PHP object injection in `DUPX_UpdateEngine::unserializeTest()` in **Duplicator ≤ 1.5.17** and **Duplicator Pro ≤ 4.6.10**. An unauthenticated attacker stores a serialized object in public site content (for example a comment). If an admin builds a package afterwards and then runs a migration or import with database search-and-replace, the object is deserialized.

In Duplicator Free a bundled Requests 1.7 POP chain gives attacker-chosen callbacks and direct OS command execution. In Pro, a destructor gadget can delete an attacker-chosen file; deleting `wp-config.php` exposes the setup wizard, which can lead to takeover if the attacker reaches it first. CVSS 3.1 is 8.8 (user interaction required, since an admin must migrate).

**Do now:** update Duplicator/Duplicator Pro past the affected versions before your next migration, and before migrating, scan comments and other public content for serialized PHP strings (`O:` followed by a class name). See [Wordfence entry](https://www.wordfence.com/threat-intel/vulnerabilities/id/767fb03a-58a3-464b-98b2-5378cfec09ae).

Sources: [CVE-2026-82814 record](https://www.cve.org/CVERecord?id=CVE-2026-82814) · [Wordfence vulnerability entry](https://www.wordfence.com/threat-intel/vulnerabilities/id/767fb03a-58a3-464b-98b2-5378cfec09ae)