Duplicator plugin PHP Object Injection (CVE-2026-82814): migration input to code execution

What happened

On 21 October 2026, CVE-2026-82814 was published for the Duplicator and Duplicator Pro WordPress plugins (all versions up to 1.5.17 and 4.6.10 respectively). During site migration, DUPX_UpdateEngine::unserializeTest() deserializes untrusted database content — and an unauthenticated attacker can reach that path, achieving PHP Object Injection.

Duplicator is one of the most-installed migration plugins in the WordPress ecosystem, so the vulnerable footprint is enormous: any site that ever left an installer or migration endpoint reachable is in scope.

Impact

PHP Object Injection becomes code execution wherever a suitable gadget chain exists in the loaded codebase — and WordPress plus its plugin soup almost always provides one. Expect site takeover, SEO spam injection, card-skimmer drops on WooCommerce checkouts, and the host conscripted into the next wave.

Root cause in one paragraph

Migration code treated database content as trusted input and passed it to unserialize(); but migrated databases routinely contain attacker-influenced rows, and the endpoint was reachable without authentication — so "import" became "execute".

What to do now

• Update Duplicator to 1.5.18+ / Duplicator Pro to 4.6.11+.
• Delete installer files (installer.php, dup-installer/ directories) from every migrated site — they should never survive go-live.
• Scan uploads and plugin directories for unknown PHP files and rogue admin users.
• Never unserialize() data that crossed a trust boundary; use JSON for import/export formats.
• If you run WooCommerce alongside Magento (common in multi-brand groups), audit both — the skimmer playbook is identical.

What this means for Magento stores

Magento has its own history of unserialize() gadgets, which is why the platform moved to JSON serializers years ago. Audit your custom modules for surviving unserialize( calls on import files, queue payloads, and API input — each one is a Duplicator-shaped hole waiting for a gadget chain. The rule is absolute: no unserialize() on anything the requester supplied.

Sources

• NVD: CVE-2026-82814
• Duplicator changelog for the fixed releases

Next in this series: PHPPresentation deserialization (CVE-2026-114403) — /blog/cve-2026-phppresentation-114403