PT-2026-136863
CVE-2026-115262
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
4.8
MediumMetricsAV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾