Wordfence Argus Finds High-Severity PHP Object Injection in Duplicator
Researchers identified an unauthenticated PHP object injection flaw in Duplicator, allowing attackers to exploit the plugin without credentials.
Key points
- Wordfence Argus discovered CVE-2026-82814, a high-severity vulnerability in Duplicator and Duplicator Pro.
- The flaw allows unauthenticated attackers to inject PHP objects into the application.
- Users must update to version 5.0.0 or newer to address the security issue.
Wordfence researchers have identified a high-severity unauthenticated PHP object injection vulnerability in the Duplicator plugin. The flaw, tracked as CVE-2026-82814, affects both Duplicator and Duplicator Pro, exposing installations to exploitation by attackers who do not possess valid login credentials.
According to Wordfence, the discovery was made using Wordfence Argus, the company’s automated vulnerability detection tool. This finding adds to recent concerns about plugin security, coming shortly after Threat Times reported on October 20, 2026, that researchers had found an unauthenticated SQL injection flaw in GLPI versions up to 11.0.8. Both incidents highlight the persistent risk of unauthenticated access flaws in widely used software components.
Details on the Vulnerability
The vulnerability allows an attacker to inject PHP objects into the application without needing to authenticate first. Because the flaw is rated as high severity, it poses a significant risk to site integrity. Wordfence explicitly advises users to update their installations to version 5.0.0 or any newer release immediately. The source material does not specify alternative mitigation strategies or confirm the security status of versions prior to 5.0.0 beyond the update recommendation.
Who Is Affected
This vulnerability impacts all users of the Duplicator plugin and its paid counterpart, Duplicator Pro. Any website running a version older than 5.0.0 is vulnerable to exploitation. Site administrators should audit their plugin versions immediately to determine if they are running affected software. The source material identifies the specific products affected but does not quantify the number of installations currently exposed to this risk.
What should you do?
Site owners should verify their current Duplicator version against the vulnerable range. If the installed version is older than 5.0.0, an immediate update is required. Administrators should also monitor server logs for signs of unauthorized access or unusual PHP execution patterns, as these could indicate exploitation attempts. Keeping plugins updated is the primary defense against such known vulnerabilities.
What to do and how to stay safe: Duplicator
- Check your current Duplicator or Duplicator Pro version and compare it to the safe threshold of 5.0.0 or higher.
- Install the latest available update immediately if your version is below 5.0.0 to patch the unauthenticated injection flaw.
- Review access logs for suspicious activity that may indicate an attacker has already exploited the vulnerability.
- Enable automated update notifications for all plugins to ensure future security patches are applied promptly.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-82814?
It is a high-severity unauthenticated PHP object injection vulnerability in Duplicator and Duplicator Pro, discovered by Wordfence Argus.
Which versions of Duplicator are vulnerable?
Any version older than 5.0.0 is affected by this security flaw.
How can I protect my site?
Update Duplicator or Duplicator Pro to version 5.0.0 or newer immediately to resolve the issue.
