CVE-2026-112244
UnknownSummary
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not prevent direct access to some bundled PHP files, which initialize without their expected context, trigger a fatal error, and return a stack trace disclosing the server's absolute filesystem paths to unauthenticated users.
Risk Assessment
Disclosure of internal server paths can aid an attacker in further reconnaissance and exploitation of other vulnerabilities. This information may help in planning attacks against the infrastructure.
Recommendation
Update Duplicator and Duplicator Pro plugins to version 5.1.0 or later. Additionally, consider disabling PHP error display in production environments.
Other vulnerabilities in Duplicator WordPress plugin
See all- CVE-2026-115262Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict their database charset and collation rewrite to schema statements during a restore. A value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
- CVE-2026-112243Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not sanitize and escape a parameter before reflecting it on one of their administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
- CVE-2026-115251High
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install plugins and exposes the routine without authentication. This allows an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory.
Original NVD description (English source)
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS