Published October 21, 2026. Based on public reports available on that date; details may change.
CVE-2026-82814 affects the Duplicator and Duplicator Pro WordPress plugins during migration processing. Sites using Duplicator through 1.5.17 or Duplicator Pro through 4.6.10 should update to a later release before creating, importing, or migrating another package, then review recent migration activity.
What happened
The vulnerability is an object-injection issue caused by deserializing untrusted database content during a Duplicator migration. In plain terms, serialized data is a way PHP represents an object for storage or transfer. It is not safe to process attacker-controlled serialized data as an object.
According to the CVE record, an unauthenticated attacker can first store specially prepared content in a public site. The vulnerable action is not automatic at that point. An administrator must later build a package and perform a migration or import that processes database search-and-replace content.
That sequence matters for incident response. The public content could be the carrier, while the impact may occur later when someone moves a site. If your team regularly builds packages for development, staging, recovery, or hosting moves, pause that workflow long enough to update and review it.
The record describes different potential outcomes in the free and Pro editions. For the free plugin, it says a bundled chain can result in operating-system command execution. For Duplicator Pro, it describes a chain that can delete an attacker-selected existing file when the installer PHP process can write to the containing directory. The record further notes that deletion of wp-config.php could expose a setup wizard and lead to further compromise under the conditions it describes.
Who is affected
The affected versions are Duplicator through 1.5.17 and Duplicator Pro through 4.6.10. Check every WordPress installation, including staging copies, because a staging site can hold the plugin and a package may later be used against a different environment.
In the WordPress dashboard, open Plugins, find Duplicator or Duplicator Pro, and record the installed version. If WP-CLI is available from the WordPress directory, use wp plugin list --name=duplicator for the free plugin. On sites where the Pro plugin uses a different directory name, wp plugin list will show the installed plugin names and versions.
Also identify people and automation that can create or import packages. The reported trigger involves an administrator migration action, so a clear record of who can perform those tasks will make the review more focused. Limiting administrator accounts is part of the broader WordPress hardening checklist.
How to check your site safely
Start by preserving information, not by deleting package files or database rows. Take a backup of the current files and database using a process you trust, and keep it separate from the working copy. If the site is already behaving unexpectedly, see the practical first steps in how to fix a hacked WordPress site.
Check the plugin version and package workflow:
- In Plugins, confirm whether Duplicator or Duplicator Pro is active and note its version.
- Review the plugin's package and migration screens for work created or run recently that your team cannot explain.
- Review WordPress administrator accounts in Users. Every administrator should map to a known person or service account.
- Review public pages, posts, and other content created shortly before a package or migration. Do not assume unfamiliar content is harmless merely because it is published.
- Check the site after an update using a private browser window and the normal monitoring you use for content and availability.
This CVE does not establish that a site with an old version has been compromised. The public report also does not say it is being exploited in the wild. Still, unexplained admin users, modified files, a strange migration history, or a missing wp-config.php deserve a fuller review. Our guide to finding hidden WordPress admin users can help with one part of that process.
What to do now
The first action is to update Duplicator or Duplicator Pro to a release later than the affected version. Use the normal update path in Dashboard, Updates or the plugin's licensed update process. If your change process requires testing, do not use an unpatched live site as the place to test a migration.
After the update, examine the access around package creation and migration. Remove administrator access that is no longer needed, use unique passwords, and protect the accounts that can make site-wide changes. A migration tool necessarily handles files and database content, so it should be limited to people who need it.
If a package or import occurred when an affected version was installed, preserve the relevant logs and copies before cleanup. Check WordPress users, wp-config.php, plugin files, and the database for changes your team cannot account for. wp core verify-checksums can identify WordPress core files that differ from the official release, although it does not check plugins, themes, or the database.
If you find signs of unauthorized changes, rotate WordPress administrator passwords, hosting and SFTP credentials, database passwords where appropriate, and any keys exposed in a configuration file. A cleanup that leaves the initial access path open can lead to repeat compromise. The WordPress malware removal service is available when you need a structured investigation and cleanup.
When to get help
Get help if you created or imported a package while an affected version was installed and cannot confidently account for the site's current users, files, and database changes. A security audit can focus on the migration workflow and access controls, while WordPress malware removal is the right starting point for a suspected compromise.