- Wordfence found that in affected Duplicator versions, an anonymous comment stored in a package can later run commands (Free) or delete files (Pro) during an administrator's migration (CVE-2026-82814).
- The harm appears only during a routine administrator task, so the attack request looks harmless when it arrives. Wordfence says endpoint-by-endpoint testing can miss this.
- Update Duplicator Free and Pro to 5.0.0 or newer. When practical, build a fresh package before migrating, rather than reusing an older one.
The attacker does not need to be there when the damage happens
Most security work watches the moment of attack. This flaw moves the harm to a later, routine job. An administrator does that job, and the attacker is long gone.
Wordfence's Threat Intelligence Team found the flaw on August 30, 2026. It is tracked as CVE-2026-82814 and affects Duplicator and Duplicator Pro, two WordPress plugins. Wordfence counts more than a million active installations of Duplicator. The severity score is 8.8 on a 10-point scale (CVSS 3.1), in the High band.
Duplicator is a backup and migration tool. Each package holds a copy of the site's files and database. A separate installer script travels with it, so the site can be rebuilt at a new address.
How a comment becomes a carrier
An attacker posts an ordinary comment through the public WordPress endpoint wp-comments-post.php. Wordfence says no account, cookie or nonce is needed. A nonce is a one-time security token. The comment hides a PHP object, written as base64 text.
Moderation does not help. Even an unapproved comment lands in the database, so it ends up in the backup. Posting the comment does no harm. Building the package only copies it.
The harm starts at migration. The installer swaps the old site address for the new one across the database. Some values use PHP's serialized format, which records string lengths and class names. A simple swap can corrupt them, so Duplicator tries to spot and repair them.
To test a value, affected versions handed it to PHP's unserialize() function. They did not limit which classes it could build. That call can create objects and run special methods automatically. If the code holds a useful chain of those methods, called a gadget chain, attacker data can steer it.
The engine also decodes base64 values. So a comment that looks like harmless encoded text can still deliver the object.
Two editions, two outcomes
Wordfence says both editions share one defect: unsafe deserialization. The impact differs. Duplicator Free 1.5.17 and earlier shipped an older Requests library inside its installer. Researchers chained it with a Duplicator class. In a live migration, they ran an operating-system command as the web-server user.
Duplicator Pro 4.6.10 and earlier used a newer library, so that chain was not available. A class named IndexList instead deletes a file at a path the attacker picks. On a throwaway test site, the researchers used this to erase wp-config.php. WordPress then reopened its setup process. An attacker who got there first could link a database they control, create an administrator and run PHP code.
Wordfence notes that the Pro path does not reveal the original site's database or credentials.
What limits the risk
The payload must be stored before the package is built. An administrator must then run a standard migration or import that reaches the Update Data step.
Making a backup alone does not trigger it. Wordfence did not test the chain through restore or recovery modes. For the Pro takeover, the target file must exist. PHP must be able to change its folder. The attacker must reach setup before the owner.
Turning off public comments closes the route the researchers showed. Wordfence says patching is still needed. Other database content an attacker controls could reach the same code.
The lesson: old backups carry old code
A backup stores data, and it also stores the tool that made it. Each package keeps the installer from the version that built it, so a package made before the patch still holds the old code.
Wordfence's follow-up tests show the effect. Pro 5.0.5's normal Import ran the older installer from a Pro 4.6.10 package and hit the weak path. Its automatic Restore forced restore mode and did not. Free 5.0.0 refused to auto-restore a Free 1.5.17 package. It told the administrator to run the installer by hand.
Wordfence found the flaw with an AI-assisted research tool called Argus. It followed attacker data past the request that stored it, into a later migration. Staff directed and checked the work. Wordfence says tests that look at one endpoint at a time can miss this kind of flaw.
What to ask your team
Wordfence reported the flaw to the vendor on August 31, 2026. Duplicator 5.0.0 shipped on September 8. Wordfence urges Free and Pro users to move to 5.0.0 or newer.
Wordfence's firewall already gave some protection through its Generic Object Injection rule. A rule aimed at this flaw reached Premium, Care and Response customers on October 15. Free users get it on November 14.
Put four questions to your web team. Which sites run Duplicator, and which version? Where are old packages kept, and will any be used for a migration soon? Will a fresh package be built first, as Wordfence advises when practical? Are unneeded installer files still publicly reachable? Wordfence says to remove them.
A routine task can be an attack path. Treat the migration, not only the login page, as a place where stored data deserves suspicion.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wordfence.
