PHP Object Injection Vulnerability in Duplicator and Duplicator Pro Plugins

CVE-2026-82814

What is CVE-2026-82814?

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection due to improper handling of untrusted database content during the migration process. This vulnerability allows unauthenticated attackers to exploit the deserialization functionality in the DUPX_UpdateEngine::unserializeTest() method. By storing a malicious serialized object within public site content prior to an administrator's migration action, attackers can trigger command execution on the operating system or delete critical files such as wp-config.php, potentially leading to site takeover. This risk emphasizes the importance of securing data handling processes within plugin functionality to prevent exploitation.

References