Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High).

This is a second-order vulnerability. An unauthenticated attacker can place a malicious value in an ordinary WordPress comment, where it remains dormant. If an administrator later creates a Duplicator package containing that comment and uses the package to migrate the site, the standalone installer treats the stored value as a PHP object and activates it.

The consequences differ between the two editions. In Duplicator Free, the classes included with the affected installer can be combined to execute an attacker-selected operating-system command. In Duplicator Pro, a different built-in class can delete an attacker-selected file. We demonstrated that deleting wp-config.php can reopen the WordPress setup process and lead to site takeover and PHP code execution when the attacker reaches the setup process first and supplies a reachable database they control.

The Wordfence Threat Intelligence Team discovered this vulnerability with the help of Wordfence Argus, our AI-assisted security research system, during a WordPress 7.1 security assessment led and validated by Alex Thomas. With the team directing the research, Argus helped trace attacker-controlled data beyond the request that stored it and into a later administrator-driven migration, where the team identified and validated the different exploitation paths present in Duplicator Free and Duplicator Pro.

Our mission is to secure WordPress through defense in depth, which is why we invest in quality vulnerability research and work closely with plugin vendors to ensure vulnerabilities are addressed before they can be widely exploited. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element of a multi-layered approach to security.

We provided full disclosure details to the Duplicator team through our Wordfence Vulnerability Management Portal on August 31, 2026. The developer acknowledged the report on September 2, 2026, and released Duplicator 5.0.0 on September 8, 2026. On September 25, 2026, the developer informed us that version 5.0.0 contained the patch. We would like to commend the Duplicator team for addressing the vulnerable migration path.

The Wordfence Firewall’s built-in Generic Object Injection protection already provided a degree of protection against this vulnerability for all Wordfence users, including those using the free version of Wordfence. During further post-patch analysis, we identified opportunities to broaden that coverage. We therefore released an additional, vulnerability-specific firewall rule to Wordfence Premium, Wordfence Care, and Wordfence Response customers on October 15, 2026. Sites using the free version of Wordfence will receive the additional protection 30 days later, on November 14, 2026.

We urge users of both Duplicator Free and Duplicator Pro to update to version 5.0.0 or a newer version as soon as possible. Updating the plugin does not rebuild packages that already exist. An older package does not activate this vulnerability simply because it is stored, but it retains the installer supplied by the version that created it. Before using a package created with an affected release for a standard migration or import, create a fresh package with an updated version when practical. We discuss the tested restore behavior below.

Vulnerability Summary from Wordfence Intelligence

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 – Unauthenticated PHP Object Injection

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-82814

Patch Status

Patched

Affected Software

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator]

Duplicator Pro [duplicator-pro]

Researchers

Alex Thomas

Wordfence Argus

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

More Details >

Technical Analysis

Duplicator is a backup and migration plugin. It creates a package containing a site’s files and database, along with a standalone installer that can rebuild the site at a new location. During a standard migration, the installer updates values such as the old site URL and filesystem path so they match the destination.

Those replacements are more complicated when a database value contains PHP-serialized data. A serialized value records not only its data, but also information such as string lengths and class names. Changing a URL inside it without repairing those lengths can corrupt the value, so Duplicator’s migration engine tries to recognize and repair serialized data while it processes the database.

The vulnerability occurs because affected versions do not merely inspect a possible serialized value. The DUPX_UpdateEngine::unserializeTest() function passes the value to PHP’s native unserialize() function without restricting which classes may be created:

try {
    LogHandler::setMode(LogHandler::MODE_OFF);
    $unserialize_ret = @unserialize($data);
    LogHandler::setMode();
    return ($unserialize_ret !== false);
}

Calling unserialize() can construct objects named by the data and automatically run special methods such as __wakeup() and __destruct(). If the application includes a useful sequence of those methods, known as a gadget chain, attacker-controlled data can cause actions the developer never intended.

The migration engine scans text-like database columns and also recognizes values that are entirely base64-encoded. It decodes those values and subjects the decoded content to the same serialized-data checks. This means the attacker can store a comment that looks like encoded text while still delivering a PHP object to unserialize() during migration.

Why the payload can come from an anonymous comment

An attacker can submit a comment through WordPress’s public wp-comments-post.php endpoint without an account, cookie, or nonce. The comment body can contain the base64-encoded object. Approval is not required because a pending comment is still stored in the WordPress database and is included in the backup when an administrator builds a Duplicator package.

Nothing dangerous happens when the comment is submitted, and package creation only copies the stored value. The payload becomes active later, when an administrator uses that newly created package for a standard migration or import and the installer reaches its Update Data search-and-replace operation.

Duplicator Free: direct command execution

Duplicator Free 1.5.17 included an older version of the Requests library in its generated installer. Using Wordfence Argus, the team combined Duplicator’s DbUserMode class with Requests_Utility_FilteredIterator. When PHP reconstructs DbUserMode, its __wakeup() method iterates over attacker-controlled data. The Requests iterator then calls a callback stored in that data:

public function current() {
    $value = parent::current();
    $value = call_user_func($this->callback, $value);
    return $value;
}

Because both the callback and its argument come from the serialized comment, the attacker can select a PHP function such as system() and supply the command it should run. We confirmed direct operating-system command execution as the web-server user during a real migration. We also independently used the same chain to delete an arbitrary file.

Duplicator Pro: file deletion leading to site takeover

Duplicator Pro 4.6.10 contained a newer Requests library, so the Free-edition callback chain was not available. It did, however, include a different usable class in every generated installer: DuplicatorLibsIndexIndexList. Its destructor deletes the path stored in the object’s path property:

public function __destruct()
{
    if (is_resource($this->handle)) {
        fclose($this->handle);
    }

    if (file_exists($this->path)) {
        unlink($this->path);
    }
}

The affected migration engine allows the serialized comment to choose that path. We first validated the behavior by deleting test files. During further testing with Wordfence Argus, the team deleted wp-config.php on a disposable WordPress installation.

When WordPress cannot find wp-config.php, it exposes its normal setup process. An attacker who reaches that process first can connect the site to a database they control, create a new administrator, and use WordPress’s normal plugin installation functionality to execute PHP code. We completed this sequence and verified code execution with a proof-of-concept plugin.

This Pro path does not reveal the original site’s database or its credentials. The demonstrated takeover uses a separate database controlled by the attacker. It still gives the attacker control of WordPress running on the affected domain and filesystem.

Important Prerequisites and Boundaries

The attacker does not need an account, but the payload does not execute immediately. It must be stored before the administrator creates the package, and the administrator must later perform a standard migration or import that runs Duplicator’s database Update Data search-and-replace process.

Simply creating a backup does not trigger the vulnerability. We also did not demonstrate this chain through Duplicator’s restore or recovery modes, which do not use the same replacement engine. The validated trigger was a standard migration or import.

Comment moderation does not stop this chain because an unapproved comment is still stored and can be copied into a package. Disabling public comments removes the carrier we demonstrated, but it is not a substitute for updating because other attacker-controlled database content may also reach the vulnerable migration engine.

For the Pro file-deletion path, the target file must exist and the PHP process running the installer must be allowed to modify its containing directory. Turning deletion of wp-config.php into site takeover also requires the attacker to reach the setup process before the site owner and to provide a reachable database they control.

The Patch

The Duplicator team addressed the vulnerable migration path in version 5.0.0. The updated engine calls SnapUtil::safeUnserialize(), which asks PHP not to instantiate classes named by serialized data:

public static function safeUnserialize($data, &$value = null): bool
{
    $value = null;

    if (!is_scalar($data) && $data !== null) {
        return false;
    }

    $data = (string) $data;
    if ($data === 'b:0;') {
        // Legitimately serialized boolean false: unserialize() also returns false here.
        $value = false;
        return true;
    }

    try {
        $result = @unserialize($data, ['allowed_classes' => false]);
    } catch (Throwable $e) {
        return false;
    }

    if ($result === false) {
        return false;
    }

    $value = $result;
    return true;
}

In this disclosed migration caller, the returned value is used only to decide whether the input is valid and is then discarded. This prevents the attacker-supplied classes from being instantiated at the vulnerable point. Duplicator Free 5.0.0 also moved away from the older Requests component used by the direct command-execution chain.

We directly verified the fix in Duplicator Free 5.0.0. We also reviewed Duplicator Pro 5.0.5 and confirmed that its relevant security files are identical to the fixed Free implementation. The vendor confirmed that Duplicator Pro 5.0.0 received the same fix.

Wordfence Firewall

The Wordfence Firewall’s built-in Generic Object Injection protection already provided a degree of protection against this vulnerability for all Wordfence users. During further post-patch analysis, we identified opportunities to broaden that coverage and developed an additional, vulnerability-specific firewall rule. Wordfence Premium, Wordfence Care, and Wordfence Response customers received the additional rule on October 15, 2026. Sites using the free version of Wordfence will receive it on November 14, 2026.

The additional rule provides more targeted coverage for the exploitation chain by detecting malicious input before WordPress can store it for later processing during a Duplicator migration.

The following graphic demonstrates the exploitation sequence and the point at which the Wordfence Firewall interrupts it.

Disclosure Timeline

Conclusion

In this blog post, we detailed a high-severity Unauthenticated PHP Object Injection vulnerability in Duplicator Free through version 1.5.17 and Duplicator Pro through version 4.6.10. An unauthenticated attacker can place a malicious object in a WordPress comment and wait for an administrator to include it in a package and use that package for a standard migration.

The shared defect is unsafe deserialization during migration, but the two editions contain different paths to impact. Duplicator Free reaches direct operating-system command execution through its bundled Requests library. Duplicator Pro exposes arbitrary file deletion, which can be developed into site takeover and PHP execution under the conditions described above.

Users should update Duplicator Free and Duplicator Pro to version 5.0.0 or a newer version. They do not need to delete an older package solely because it was created with an affected release: the archive does not activate this vulnerability while it remains stored. However, it still contains its original installer, and a standard migration or import can reach that older vulnerable code. Create a fresh package with an updated version before a migration or import when practical, and remove publicly accessible standalone installer files that are no longer needed.

The Wordfence Firewall’s built-in Generic Object Injection protection provides a degree of protection against this vulnerability for all Wordfence users. Following further post-patch analysis, we developed an additional, vulnerability-specific rule to broaden that coverage. Wordfence Premium, Wordfence Care, and Wordfence Response customers received the additional rule on October 15, 2026. Sites using the free version of Wordfence will receive it on November 14, 2026.

This finding illustrates how the Wordfence Threat Intelligence Team uses Wordfence Argus to follow data across complete application workflows. The attacker’s request appears harmless when it arrives. The security impact appears only later, inside an administrator’s legitimate migration—a relationship that endpoint-by-endpoint testing can easily miss.

If you know someone who uses Duplicator on their site, we recommend sharing this advisory with them to help ensure their site remains secure.

The post Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator appeared first on Wordfence.