Duplicator Object Injection CVE-2026-82814 Allows Unauthenticated RCE and File Deletion

Unauthenticated attackers can achieve remote code execution or delete critical files on WordPress sites running vulnerable versions of Duplicator. This capability arises when an attacker stores malicious serialized data in public content, which is later processed during a site migration. The flaw grants significant control over the server environment without requiring login credentials, posing a severe risk to managed environments.

How it unfolded

• Attackers place serialized objects in public site content accessible without authentication.
• An administrator creates a backup package after the malicious content is stored.
• The migration process triggers deserialization of the untrusted database content.
• Exploitation of bundled PHP objects leads to command execution or file deletion.

Who is affected

The Duplicator plugin for WordPress is vulnerable in all versions up to and including 1.5.17, according to the National Vulnerability Database. Duplicator Pro is affected in versions up to and including 4.6.10. The vulnerability stems from how these plugins handle deserialization during migration tasks. Sites using these older versions are exposed to unauthenticated attacks that can compromise server integrity.

The fix

Wordfence Argus, the research tool that discovered the flaw, advises updating to version 5.0.0 or newer, according to Wordfence. This update addresses the high-severity PHP object injection vulnerability identified as CVE-2026-82814. Users of both the free and Pro versions should verify their current installation matches the patched version to mitigate the risk of unauthorized access or data loss through the described vector.

What made it possible

Teams usually monitor for insecure deserialization risks when managing plugins that process complex data formats. This technique exploits the failure to validate untrusted data before converting it into executable objects. It serves the initial access or privilege escalation stage of an intrusion, allowing attackers to bypass authentication. Check whether applications sanitize inputs thoroughly to prevent such object injection attacks from succeeding during routine administrative operations.

Background: Insecure deserialization

Insecure deserialization occurs when an application processes untrusted data without verifying its integrity or structure. Attackers craft malicious serialized objects that, when reconstructed, execute arbitrary code. You can stop this by rejecting untrusted input, enforcing strict type checks, and using integrity checks like digital signatures.

Read the full guide: Insecure Deserialization: Step-by-Step Attack Breakdown

What to do and how to stay safe: Duplicator

• Verify the installed version of Duplicator and Duplicator Pro against the patched 5.0.0 release.
• Monitor server logs for unexpected file deletions or command execution attempts during migrations.
• Restrict public write access to site content where possible to limit carrier storage opportunities.
• Review plugin configurations to ensure migration tasks are initiated only by authorized administrators.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What severity level does CVE-2026-82814 have?

The vulnerability has a CVSS score of 8.8, which is classified as high severity.

Can an attacker exploit this flaw without logging in?

Yes, the vulnerability allows unauthenticated attackers to store malicious serialized objects in public site content.

Which specific versions of Duplicator are affected?

Duplicator is vulnerable up to version 1.5.17, and Duplicator Pro is vulnerable up to version 4.6.10.