CVE-2026-115251
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade
Unknown Duplicator
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.0.0DuplicatorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
2 outlets mention it. Reports are not confirmation; each links to its source.
- @offseq.bsky.social: HIGH severity in Duplicator WordPress plugin (1.5.17 – <5.0.0): Improper privilege management lets multisite child admins execute PHP code network-wide. Limit admin access & monitoBluesky: CVE posts, 25 Oct 2026
- 🚨 CVE-2026-115251 The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exTelegram: CVE Notify, 25 Oct 2026
Description
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Text from CVE List
Affected versions 1
- Duplicatoraffected: 1.5.17 before 5.0.0CVE List