HIGH
Duplicator
CVE published 2026-10-21
CVE-2026-82814
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. The vulnerability affects versions up to, and including, 1.5.17 and 4.6.10, respectively. Defenders s [truncated]