Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

Reported by Wordfence (Alex Thomas)

Summary by Cyber Security News20 Oct 2026, 20:32 CET

About this summary. This is a short excerpt from the description that Wordfence published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-high-severity-unauthenticated-php-object-injection-in-duplicator/

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High).

Read the full article at Wordfence →

Source attribution: headline and facts are from Wordfence (wordfence.com). Summary method: excerpt of the source description. See our source attribution policy.