CVE-2026-115262

Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 5.1.0 duplicator-pro WordPress plugin versions prior to 5.1.0

Description Insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow authenticated attackers with Subscriber-level access or higher to perform SQL Injection. The issue occurs during a restore process because the plugin does not restrict database charset and collation rewrite to schema statements. This allows a value stored in a user profile to break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server that lacks one of the source's charsets or collations. This can be used to extract sensitive information from the database.

Recommendations Update Duplicator WordPress plugin to version 5.1.0 or later. Update duplicator-pro WordPress plugin to version 5.1.0 or later.