PatchSiren

Snap Creek CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Snap Creek CVE published 2026-10-25

CVE-2026-115251

The Duplicator WordPress plugin before 5.0.0 has a vulnerability allowing an administrator of a multisite child site, who is not a network administrator, to install and run arbitrary PHP in the network-wide shared Duplicator directory due to an unrestricted one-click upgrade routine exposed without authentication. This issue arises from the plugin's failure to properly restrict access to its upgrade funct [truncated]