CVE-2026-82814

Name of the Vulnerable Software and Affected Versions Duplicator versions prior to 5.0.0 Duplicator Pro versions prior to 5.0.0

Description An unauthenticated PHP Object Injection exists due to the deserialization of untrusted database content within the unserializeTest() function of the DUPX UpdateEngine class during migration. Attackers can store a serialized object in public site content which is then processed when an administrator builds a package and performs a migration or import involving database search-and-replace. In the free version, a Requests 1.7 POP chain allows for direct operating-system command execution via attacker-selected callbacks. In the Pro version, an IndexList destructor gadget enables the deletion of a specific file if the directory is writable by the installer PHP process; for instance, deleting wp-config.php can trigger the setup wizard, potentially leading to site takeover and code execution if the attacker provides a database they control.

Recommendations Update Duplicator to version 5.0.0. Update Duplicator Pro to version 5.0.0.