Arbitrary PHP Execution Vulnerability in Duplicator Plugin for WordPress
CVE-2026-115251
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 25 October 2026
Badges
What is CVE-2026-115251?
The Duplicator plugin for WordPress prior to version 5.0.0 contains a security flaw that permits unauthorized users to execute arbitrary PHP code on a multisite environment. Specifically, the plugin's one-click upgrade feature lacks sufficient access controls and is exposed without authentication. This vulnerability allows an administrator of a child site within a multisite network, who does not have network-wide administrative privileges, to exploit this flaw. As a result, they could access the shared Duplicator directory and execute potentially harmful scripts, presenting a serious risk to the network's overall security.
Affected Version(s)
Duplicator 1.5.17 < 5.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.