CVE-2026-112244

Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 5.1.0 duplicator-pro WordPress plugin versions prior to 5.1.0

Description Certain bundled PHP files do not prevent direct access, allowing them to initialize without their expected context. This triggers a fatal error and returns a stack trace that discloses the server's absolute filesystem paths to unauthenticated users. This Full Path Disclosure can be used to assist in further attacks against the web application.

Recommendations Update Duplicator WordPress plugin to version 5.1.0 or later. Update duplicator-pro WordPress plugin to version 5.1.0 or later.