Duplicator <= 5.1.0 - Unauthenticated Installer Password Bypass via Installer AJAX Actions and API Router
- ID
- WPSEC-2026-2476
- Plugin
- Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More (duplicator)
- Affected
- all versions before 5.1.1
- Remediation
- Update to 5.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-306
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Duplicator on WPSec AttackSurface
- Fix released
- Published
Description
The Duplicator plugin for WordPress is vulnerable to Authentication Bypass via the installer's AJAX actions and API router in all versions up to, and including, 5.1.0. This is due to the installer AJAX controller and the API router (router.php) only checking a CSRF token and never checking whether the installer password or archive security check has been passed. The tokens for every installer action are printed on the installer's own password page. This makes it possible for unauthenticated attackers to run installer actions without knowing the installer password, such as setting installer parameters, extracting the archive, installing the database and updating the site, as well as cPanel API calls. Exploitation requires a password-protected Duplicator installer to be present and reachable on the server.
References
- https://wpsec.com/vuln/WPSEC-2026-2476/
- https://plugins.svn.wordpress.org/duplicator/tags/5.1.1/
- https://wordpress.org/plugins/duplicator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS