VulnSocial

CVE-2026-115251

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-25: 110-25
Referenced assets1 URL
Full discourse1 post
  • Donweb Media@DonwebMedia

    Si tenés una red multisitio de WordPress con Duplicator, esto es para leer ya: la CVE-2026-115251 permite ejecutar PHP sin necesitar ser admin de red. Ya hay parche en la 5.0.0, así que a actualizar https://seguridadenwordpress.com/cve-2026-115251-duplicator-multisitio-wordpress/

    0000036
    9 followersView on X

Explore more

Back to dashboard