CVE-2026-115251: Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade

Q: Which environments are exposed to this issue?

WordPress multisite deployments using the Snap Creek Duplicator plugin before version 5.0.0 are exposed. The affected plugin directory is network-wide shared, so impact extends beyond an individual child site.

Q: What access does an attacker need?

A multisite child-site administrator who is not a network administrator can exploit the issue. The one-click upgrade routine is also exposed without authentication.

Q: What can successful exploitation allow?

An attacker can install and execute arbitrary PHP in the network-wide shared Duplicator plugin directory. This can lead to code execution affecting the shared plugin installation.

Published Oct 25, 2026

Updated

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.

Affected Software

1 affected component

Snap Creek Duplicator WordPress plugin<5.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Duplicator WordPress plugin to a version that resolves this vulnerability.
Fixed in 5.0.0

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which environments are exposed to this issue?

WordPress multisite deployments using the Snap Creek Duplicator plugin before version 5.0.0 are exposed. The affected plugin directory is network-wide shared, so impact extends beyond an individual child site.

What access does an attacker need?

A multisite child-site administrator who is not a network administrator can exploit the issue. The one-click upgrade routine is also exposed without authentication.

What can successful exploitation allow?

An attacker can install and execute arbitrary PHP in the network-wide shared Duplicator plugin directory. This can lead to code execution affecting the shared plugin installation.

CVE-2026-115251: Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade

Affected Software

Remediation

Event History

Frequently Asked Questions

Which environments are exposed to this issue?

What access does an attacker need?

What can successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed to this issue?

What access does an attacker need?

What can successful exploitation allow?