CVE-2026-115251: CWE-269 Improper Privilege Management in Duplicator
Affects DuplicatorSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Duplicator | Affected
| Fixed in
|
AI-suggested
Until a fix is available, restrict administrative access on multisite child sites and monitor for suspicious activity related to the Duplicator plugin's upgrade routine.
Description
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Impact
An attacker with administrator privileges on a multisite child site can escalate privileges by executing arbitrary PHP code in the shared plugin directory. This could lead to full compromise of the multisite WordPress network, including unauthorized code execution and potential control over other sites in the network.
Weaknesses
- CWE-269Improper Privilege Management (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.