SECURITY researchers have disclosed a high-severity unauthenticated PHP object injection vulnerability in the Duplicator WordPress plugin and Duplicator Pro, tracked as CVE-2026-82814. Wordfence reports the flaw allows an attacker to plant a dormant payload in a public WordPress comment, which can be activated when an administrator later creates a Duplicator package for site migration. The end result can range from execution of operating-system commands to full site takeover, depending on the edition used.
The advisory notes this is a second-order vulnerability: the malicious value rests in a comment until a subsequent migration package triggers deserialization and code execution.
Affected products comprise Duplicator Free up to version 1.5.17 and Duplicator Pro up to 4.6.10, with version 5.0.0 and newer patching the issue. The reported CVSS base score is 8.8 (High, CVSSv3). Evidence from Wordfence indicates the bug was identified on 30 August 2026 during a WordPress 7.1 assessment led by Alex Thomas; at the time of reporting there was no public PoC exploit and no confirmed in-the-wild exploitation.
The fix introduces SnapUtil::safeUnserialize(), which disables allowed_classes during deserialization. Administrators are urged to update to 5.0.0 or newer and, crucially, regenerate migration packages with the patched release before performing site migrations, since older packages may still contain the dormant payload. No confirmed exploitation has been publicly verified beyond vendor advisories.