SQL Injection Vulnerability in Duplicator Plugin for WordPress
CVE-2026-115262
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 November 2026
Badges
What is CVE-2026-115262?
The Duplicator WordPress plugin, both in its free and Pro versions prior to 5.1.0, is vulnerable to SQL injection attacks. This vulnerability arises because the plugin does not adequately restrict database charset and collation during the restoration of backups. Specifically, if a Subscriber's profile contains a value that breaks out of its string literal, it can inject malicious SQL into the restore's INSERT statement. This occurs particularly when the backup is restored on a server that lacks one of the original database's charsets or collations, potentially compromising the site's security.
Affected Version(s)
Duplicator 0 < 5.1.0
duplicator-pro 5.0.0 < 5.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.