CVE-2026-82814

{
  "etk_id": "ETK-2026-2264",
  "cve_id": "CVE-2026-82814",
  "display_id": "CVE-2026-82814",
  "ghsa_id": "GHSA-pq4f-mjh8-pjp9",
  "euvd_id": "EUVD-2026-107032",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe object deserialization in Duplicator WordPress plugins",
  "summary": "Duplicator versions through 1.5.17 and Duplicator Pro versions through 4.6.10 process untrusted database content unsafely during migration operations. An unauthenticated attacker who can place content on the site before an administrator builds and runs a migration package may achieve command execution in the free plugin or delete files in the Pro plugin.",
  "mitigation": "Deactivate the affected plugin or prevent package creation and migration/import operations on sites that accept untrusted public content until a vendor-fixed release is confirmed. Restrict public content submission and ensure the installer PHP process cannot write sensitive application files.",
  "vendor": "smub",
  "product": "Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.5.17"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.6.10"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Duplicator Pro",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 32.991056,
  "t0_at": "2026-10-21T01:30:35.849000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T01:30:35.849000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T01:30:35.849000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82814"
    }
  }
}