CVE-2026-115251 Snap Creek CVE debrief

Who should care

Administrators of WordPress multisite installations using the Duplicator plugin should assess exposure and verify their version. They should also restrict upgrade access, monitor for suspicious activity, and ensure that proper security measures are in place to mitigate potential exploitation.

Why it matters

CVE-2026-115251 allows an administrator of a multisite child site to install and run arbitrary PHP in the network-wide shared Duplicator directory; assess exposure, restrict upgrade access, and monitor for suspicious activity.

• Potential for arbitrary PHP execution in the network-wide shared Duplicator directory
• Possible exploitation by administrators of multisite child sites
• Need for verification of plugin version and access restrictions
• Potential impact on network security if exploited

Technical summary

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install the plugin, and exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory. This vulnerability stems from inadequate access controls and authentication mechanisms in the plugin's upgrade process, posing significant security risks to affected installations.

Defensive priority

Assess exposure and verify version; restrict upgrade access; monitor for suspicious activity

Recommended defensive actions

• Assess exposure by checking if the Duplicator plugin version is before 5.0.0
• Restrict access to the upgrade routine to authorized users only
• Monitor for suspicious activity related to the Duplicator plugin
• Verify plugin version and configuration
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review source reference for additional guidance

Evidence notes

The vulnerability allows an administrator of a multisite child site to install and run arbitrary PHP; no exploitation or impact details are provided. The issue is attributed to the plugin's one-click upgrade routine being exposed without authentication and not being restricted to authorized users. Evidence is limited to the CVE description and plugin version details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.