Security notice

Use Duplicator to move WordPress sites? Update it before your next migration.

Last updated: Thursday, October 22, 2026, 3:58 PM ETStatus: Fix released (version 5.0.0). No attacks reported yet.

Duplicator is a popular WordPress plugin for backing up sites and moving them to a new host or domain. WordPress.org lists it on more than 1 million sites. On October 20, 2026, the security company Wordfence published details of a high severity flaw, CVE-2026-82814, rated 8.8 out of 10. Someone with no account can hide a booby trapped value in an ordinary blog comment. Nothing happens until a site admin later builds a Duplicator package and uses it to migrate or import the site. At that point, the free version can run the attacker's commands on the server, and the Pro version can delete files, which can lead to a full site takeover. The fix is in version 5.0.0, released September 8. If you or your agency use Duplicator, update it before your next migration, and make a fresh package with the updated version.

What happened

The flaw. Wordfence says Duplicator's migration installer unpacks stored data from the site's database in an unsafe way. An attacker can submit a comment containing encoded data. If that comment ends up in a package that is later used for a migration or import, the installer turns it into live code. (Wordfence, NVD)
No account needed, and moderation doesn't stop it. Wordfence says a comment waiting for approval is still stored in the database and is still copied into the package. (Wordfence)
What is at stake. In Duplicator Free, Wordfence showed the attacker's chosen operating system command running during a real migration. In Duplicator Pro, it showed an attacker could delete a chosen file, such as wp-config.php, and then take over the site under certain conditions. (Wordfence)
What does not trigger it. Wordfence says simply creating a backup does not trigger the flaw, and it did not reproduce the attack through Duplicator's restore or recovery modes. The trigger it confirmed is a standard migration or import. (Wordfence)
The timeline. Wordfence reported the flaw to Duplicator on August 31, 2026. Duplicator released 5.0.0 on September 8, and Wordfence published the details on October 20. (Wordfence, Duplicator changelog)
No attacks reported yet. None of the sources we checked report attacks using this flaw as of October 22, 2026, and it is not on CISA's list of exploited flaws.

Who should worry

Ask about this if you, your developer or your agency use Duplicator to back up, copy or move WordPress sites. You are affected if any of these are true:

Duplicator (free) is on version 1.5.17 or older.
Duplicator Pro is on version 4.6.10 or older.
You plan to migrate or import a package that was created with one of those older versions, even if the plugin is now updated.

The risk is highest for agencies and freelancers who migrate client sites often, and for sites that accept public comments. If you don't use Duplicator, this flaw is not about your site.

What to do now

Do these before your next migration.

Update Duplicator. Wordfence says to update both Duplicator and Duplicator Pro to 5.0.0 or later. The current version on WordPress.org is 5.0.6. Starting with 5.0.0, the free and Pro editions share one version number. (Wordfence, WordPress.org, Duplicator changelog)
Don't migrate or import with an old package. Updating the plugin does not fix packages you already made. Each old package carries the old installer. Wordfence says to create a fresh package with the updated plugin before a migration or import when practical. You don't need to delete old backups just for this. (Wordfence)
Clean up old installer files. Wordfence says to remove publicly accessible Duplicator installer files you no longer need. (Wordfence)
Look at your comments. Before you build a new package, check pending, spam and approved comments for long blocks of random looking letters and numbers, and remove anything you don't recognize. Wordfence says turning off comments removes the route it tested but is not a substitute for updating. (Wordfence)
Agencies: check every client site where Duplicator is installed, not only the one you are moving today.

What to send your developer, agency or host

Wordfence published CVE-2026-82814 (CVSS 8.8, High) on October 20, 2026. It affects Duplicator 1.5.17 and older and Duplicator Pro 4.6.10 and older. An unauthenticated attacker can store a payload in a WordPress comment, even an unapproved one, that runs during a later Duplicator migration or import: command execution in the free version, file deletion leading to possible site takeover in Pro. Please confirm whether any site you manage for us uses Duplicator, update it to 5.0.0 or later, and do not run any migration or import with a package created by an older version. Please make a fresh package with the updated plugin instead, and remove any leftover public installer files. Sources: Wordfence, Duplicator changelog.

Technical steps

Step 1. Check your version

In WordPress, go to Plugins and look at the Duplicator or Duplicator Pro version. You are fixed on 5.0.0 or later. With WP-CLI:

wp plugin list --name=duplicator

(Wordfence, WordPress.org)

Step 2. Update

wp plugin update duplicator

For Pro, update from the Plugins screen or download the latest version from your Duplicator account.

Step 3. Rebuild packages before migrating

Create a new package with the updated plugin before any migration or import. Wordfence found that importing an old Pro 4.6.10 package through Pro 5.0.5's Import workflow still ran the old installer and reached the vulnerable code. (Wordfence)

Step 4. Remove leftovers

Delete installer files and archives left in public folders after past migrations.

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. None of the sources we checked report attacks using this flaw as of October 22, 2026, and the attack only works if someone runs a migration or import with an affected package. Update before your next migration rather than wait.

Can EverThread tell me if I am affected?

No. EverThread checks websites from the outside, the way a browser sees them. We cannot see which plugins your site has installed or which versions they run, and we do not test for this flaw. You can check in a minute on your WordPress Plugins screen. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

I only use Duplicator for backups. Am I at risk?

Wordfence says creating a backup does not trigger the flaw, and it did not reproduce the attack through restore or recovery modes. Update anyway, because a backup you make today could be used for a migration later. (Wordfence)

We updated in September. Are we safe?

Probably, if that update brought you to 5.0.0 or later. Packages made before the update still carry the old installer, so make new ones before your next migration. (Wordfence)

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Wordfence: Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator, October 20, 2026
NVD: CVE-2026-82814
Duplicator: Changelog (5.0.0, September 8, 2026)
WordPress.org: Duplicator plugin page