CVE-2026-82814 (CVSS 8.8): Unauthenticated PHP Object Injection in Duplicator and Duplicator Pro allows OS command execution or site takeover via a second-order deserialization flaw triggered during migration. Affects 1M+ active installs. Technical breakdown: - CVE-2026-82814 affects Duplicator Free through 1.5.17 and Duplicator Pro through 4.6.10. The root cause is DUPX_UpdateEngine::unserializeTest() calling PHP's native unserialize() without restricting which classes may be instantiated, allowing attacker-supplied class names to trigger __wakeup() and __destruct() methods automatically. The payload can also be base64-encoded, since the migration engine decodes and deserializes base64 content from database columns. - This is a second-order vulnerability with a multi-step chain. An unauthenticated attacker posts a base64-encoded serialized PHP object as a WordPress comment via the public wp-comments-post.php endpoint, no account or nonce required. The comment is stored in the database even if pending. Nothing fires on submission or package creation. The payload activates only when an administrator later runs a standard migration or import using a package that contains that comment, triggering the Update Data search-and-replace operation. - The two editions reach different impact. In Duplicator Free, the installed Requests 1.7 library provides a POP chain combining DbUserMode's __wakeup() with Requests_Utility_FilteredIterator, letting the attacker specify any PHP callback and argument, confirmed to achieve OS command execution as the web-server user. In Duplicator Pro, the IndexList destructor's unlink() call enables arbitrary file deletion. Deleting wp-config.php exposes the WordPress setup wizard, and an attacker who reaches it first and supplies a controlled database can create a new administrator and execute PHP code via plugin installation. - Stored packages do not self-trigger, but they permanently retain the installer from the version that created them. Post-patch testing confirmed that Duplicator Pro 5.0.5's Import workflow ran an older Pro 4.6.10 package installer and hit the vulnerable deserialization path. The fix in version 5.0.0 replaces the unsafe call with SnapUtil::safeUnserialize(), passing ['allowed_classes' => false] to PHP's unserialize() so no attacker-named classes are instantiated. Comment moderation is not a mitigation: unapproved comments are still copied into packages. - Patch released September 8, 2026. Actively exploited in the wild: not stated in the report. The fix is confirmed in Duplicator Free 5.0.0 and Duplicator Pro 5.0.0 and later. Practitioner takeaway: Update both Duplicator Free and Duplicator Pro to 5.0.0 or newer immediately. Updating the plugin does not retroactively fix older stored packages. Before using any package created under an affected version for a migration or import, build a fresh package with the updated plugin. Remove any publicly accessible standalone installer files (installer.php) left on disk from previous migrations. To hunt for pre-planted payloads, inspect the wp_comments table in your WordPress database for comment_content containing base64-encoded strings that decode to values beginning with serialized PHP object notation (O: or C:), particularly in comments with comment_approved set to 0 (pending). Those entries should be treated as suspect and removed before any migration is run. #DFIR_Radar
