Unauthorized Access Vulnerability in Duplicator Plugin by WordPress
CVE-2026-112244
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-112244?
The Duplicator WordPress plugin and its Pro variant prior to version 5.1.0 are susceptible to unauthorized access. An attacker may exploit this vulnerability to gain direct access to certain bundled PHP files. This oversight allows these files to initialize without the expected context, potentially resulting in fatal errors alongside stack traces. Such stack traces can inadvertently reveal the server's absolute filesystem paths to unauthenticated users, posing a significant security risk.
Affected Version(s)
Duplicator 5.0.0 < 5.1.0
duplicator-pro 5.0.0 < 5.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.