Duplicator vulnerabilities
We track 3 vulnerabilities in Duplicator products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 25, 2026.
Latest Duplicator vulnerabilities
- 7.2 High severity
Duplicator: Improper Privilege Management
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multi
- 8.8 High severity
Duplicator – Backups & Migration Plugin –…: Deserialization of Untrusted Data
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() duri
- 7.5 High severity
Duplicator: Files or Directories Accessible to External Parties
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containin