A flaw in the popular Duplicator WordPress plugin lets an attacker plant a dormant payload in an ordinary website comment that only fires when the site owner later migrates the site, researchers at Wordfence have found. The vulnerability, tracked as CVE-2026-82814 and scored 8.8 out of 10, affects Duplicator Free up to version 1.5.17 and Duplicator Pro up to version 4.6.10. Duplicator has more than one million active installations, making it one of the most widely used backup and migration tools for WordPress sites.

How the two-stage attack works

The attack works in two stages. First, an attacker with no account on the site submits a comment containing a specially crafted, encoded value. Comment moderation offers no protection, because WordPress stores even unapproved comments in its database. Nothing harmful happens at this point. The payload simply waits.

The second stage begins when an administrator builds a Duplicator package containing that comment and uses it to move the site. During migration, the installer tries to repair stored values and passes them to PHP's built-in unserialise function without restricting which classes may be created. That turns stored text into a live object. In Duplicator Free, researchers chained the flaw with an older bundled library to run operating system commands as the web server user. In Duplicator Pro, a different built-in class could delete a file of the attacker's choosing, and Wordfence showed that deleting wp-config.php could reopen the WordPress setup process and lead to full site takeover.

Fix: update and discard old packages

The fix is to update to Duplicator 5.0.0 or newer, which blocks the unsafe deserialisation. Updating alone is not enough for old backups: because migration packages carry their own copy of the installer, administrators should discard packages built with the vulnerable release and generate fresh ones with the patched version before their next migration.

Sources: Wordfence; SecurityOnline.