CVE-2026-112244: Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points

Published Nov 4, 2026

Updated

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Duplicator WordPress plugin to a version that resolves this vulnerability.
Fixed in 5.1.0
Upgrade
Upgrade duplicator-pro WordPress plugin to a version that resolves this vulnerability.
Fixed in 5.1.0

Event History

Nov 4, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can request the affected bundled PHP installer entry points directly. No account or user interaction is required.

What information can be exposed?

The resulting fatal error and stack trace can reveal absolute filesystem paths on the WordPress server. The supplied data indicates confidentiality impact only; it does not indicate integrity or availability impact.

Which deployments are affected?

Duplicator versions 5.0.0 through 5.0.6 and Duplicator Pro versions before 5.1.0 are affected. The issue concerns bundled PHP files that can be accessed directly.