CVE-2026-115251
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
| Vendor | unknown |
| Product | duplicator |
| Published | Oct 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown duplicator
Be the first to know when new unknown vulnerabilities affecting unknown duplicator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Duplicator
1.5.17 < 5.0.0
References
Credits
Charles Vosburgh WPScan