CVE-2026-115262: Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Duplicator WordPress pluginto a version that resolves this vulnerability.Fixed in 5.1.0 - Upgrade
Upgrade
duplicator-pro WordPress pluginto a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Duplicator or Duplicator Pro before 5.1.0 are affected if an administrator restores a backup onto a server that lacks a charset or collation present in the source backup. The injected value must have been stored beforehand by a user with Subscriber-level access.
What conditions are required for exploitation?
An attacker needs a Subscriber account or equivalent ability to store a crafted value in their own profile. An administrator must later restore the affected backup, and the restore environment must be missing a source charset or collation so that Duplicator's rewrite logic is invoked.
Is a normal restore always vulnerable?
No. The issue depends on the charset and collation rewrite occurring during restore, which the provided data says happens when the destination server lacks one of the source server's charsets or collations.
What can be done if updating is not immediately possible?
Avoid restoring affected backups to servers lacking charsets or collations used by the source environment. Restrict Subscriber account creation and review profile values from untrusted Subscriber accounts before creating or restoring backups.
How can administrators assess whether a restore may be affected?
Check whether the installed Duplicator or Duplicator Pro version is earlier than 5.1.0, whether backups include data from Subscriber accounts, and whether the planned restore server lacks a charset or collation used by the source server.