high7.2
CVE-2026-115251
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0…
Impact
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Affected products
| Product | Affected versions |
|---|---|
| Duplicator WordPress Plugin | before 5.0.0 |
| Network-Wide Shared Duplicator WordPress Plugin | before 5.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.