CVE-2026-115251
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Description
CNA (WPScan)
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Duplicator | affected: 1.5.17 … < 5.0.0 default: unaffected |
Linux distribution status
References (1)
- https://wpscan.com/vulnerability/c4512e96-6d96-474e-90c0-ad784eb1c145/ CNA exploitvdb-entrytechnical-description