{
 "id": "WPSEC-2026-2476",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2476/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2476/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2476/index.md",
 "title": "Duplicator <= 5.1.0 - Unauthenticated Installer Password Bypass via Installer AJAX Actions and API Router",
 "description": "The Duplicator plugin for WordPress is vulnerable to Authentication Bypass via the installer's AJAX actions and API router in all versions up to, and including, 5.1.0. This is due to the installer AJAX controller and the API router (router.php) only checking a CSRF token and never checking whether the installer password or archive security check has been passed. The tokens for every installer action are printed on the installer's own password page. This makes it possible for unauthenticated attackers to run installer actions without knowing the installer password, such as setting installer parameters, extracting the archive, installing the database and updating the site, as well as cPanel API calls. Exploitation requires a password-protected Duplicator installer to be present and reachable on the server.",
 "plugin": {
  "slug": "duplicator",
  "name": "Duplicator",
  "full_name": "Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More",
  "wordpress_org": "https://wordpress.org/plugins/duplicator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/duplicator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/duplicator"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-306"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.1",
 "remediation": "Update to 5.1.1 or later.",
 "fix_released": "2026-11-03T12:28:31+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:57:42.766842+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2476/",
  "https://plugins.svn.wordpress.org/duplicator/tags/5.1.1/",
  "https://wordpress.org/plugins/duplicator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/duplicator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}