PT-2026-122951

CVE-2026-115251

Published

2026-10-25

Updated

2026-10-25

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 5.0.0

Description The one-click upgrade routine is exposed without authentication and does not restrict access to authorized users. This allows an administrator of a multisite child site, who lacks network administrator privileges, to install and execute arbitrary PHP code within the network-wide shared plugin directory.

Recommendations Update Duplicator WordPress plugin to version 5.0.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Charles Vosburgh

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

Related identifiers