# Duplicator <= 5.1.0 - Unauthenticated Installer Password Bypass via Installer AJAX Actions and API Router

- **ID:** WPSEC-2026-2476
- **Plugin:** Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More (`duplicator`), https://wordpress.org/plugins/duplicator/
- **Affected versions:** all versions before 5.1.1
- **Fixed in:** 5.1.1 (Update to 5.1.1 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-306
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/duplicator
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2476/

## Description

The Duplicator plugin for WordPress is vulnerable to Authentication Bypass via the installer's AJAX actions and API router in all versions up to, and including, 5.1.0. This is due to the installer AJAX controller and the API router (router.php) only checking a CSRF token and never checking whether the installer password or archive security check has been passed. The tokens for every installer action are printed on the installer's own password page. This makes it possible for unauthenticated attackers to run installer actions without knowing the installer password, such as setting installer parameters, extracting the archive, installing the database and updating the site, as well as cPanel API calls. Exploitation requires a password-protected Duplicator installer to be present and reachable on the server.

## References

- https://wpsec.com/vuln/WPSEC-2026-2476/
- https://plugins.svn.wordpress.org/duplicator/tags/5.1.1/
- https://wordpress.org/plugins/duplicator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2476/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.