Duplicator CVE-2026-82814: dormant PHP object injection in comments

Wordfence found an unauthenticated PHP object injection flaw, CVE-2026-82814 (CVSS 8.8), in the Duplicator and Duplicator Pro WordPress plugins. A base64-encoded object planted in a comment stays dormant until an admin migrates the site, then triggers command execution in the free edition or arbitrary file deletion in Pro. Fixed in version 5.0.0.

• CVE-2026-82814 scores 8.8 under CVSSv3
• Payload sits in a comment and fires during migration via DUPX_UpdateEngine
• Free edition allows RCE; Pro allows deleting wp-config.php
• Duplicator up to 1.5.17 and Pro up to 4.6.10 affected, fixed in 5.0.0