CVE-2026-115262
UnknownSummary
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict their database charset and collation rewrite to schema statements during a restore. A value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
Risk Assessment
A Subscriber can inject SQL into the restore operation, potentially leading to modification or disclosure of database data.
Recommendation
Update the Duplicator and Duplicator Pro plugins to version 5.1.0 or later.
Other vulnerabilities in Duplicator WordPress plugin
See all- CVE-2026-112244Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not prevent direct access to some bundled PHP files, which initialize without their expected context, trigger a fatal error, and return a stack trace disclosing the server's absolute filesystem paths to unauthenticated users.
- CVE-2026-112243Unknown
The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not sanitize and escape a parameter before reflecting it on one of their administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
- CVE-2026-115251High
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install plugins and exposes the routine without authentication. This allows an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory.
Original NVD description (English source)
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS