An anonymous WordPress comment, left sitting unapproved in a moderation queue, can turn into remote code execution weeks later when a site owner migrates the site with Duplicator. That is the finding of Alex Thomas of the Wordfence Threat Intelligence Team, working with the company's AI-assisted research system Wordfence Argus, in a disclosure published this week.
Duplicator, a backup and migration plugin, has more than one million active installations. The flaw, CVE-2026-82814 (CVSS 8.8, High), affects Duplicator up to 1.5.17 and Duplicator Pro up to 4.6.10. The developer shipped the fix in version 5.0.0 on September 8, 2026, so sites that have updated are covered, and Wordfence's write-up does not report any exploitation in the wild.
A dormant payload that waits for the migration
This is a second-order bug. An attacker with no account submits a comment containing a base64-encoded, serialized PHP object through WordPress's public comment form. WordPress stores it even if it is never approved, and at that point nothing happens. If an administrator later builds a Duplicator package that includes the comment and uses it for a standard migration or import, the installer's search-and-replace step decodes the value and hands it to PHP's unserialize() function, inside DUPX_UpdateEngine::unserializeTest(), without restricting which classes may be created. That lets the stored data build objects whose automatic methods run attacker-chosen actions.
What the attacker gets depends on the edition:
- Duplicator Free: the installer bundled an older Requests library, and Wordfence chained it with Duplicator's own classes to run an attacker-chosen operating system command as the web server user during a real migration.
- Duplicator Pro: a built-in class can delete an attacker-chosen file. Wordfence deleted wp-config.php on a disposable test site, which reopens WordPress's setup process; an attacker who reaches it first and points it at a database they control can create an administrator and run PHP code.
There are real limits. The comment must be stored before the package is built, an administrator must run a standard migration or import, and simply creating a backup does not trigger anything. Wordfence did not demonstrate the chain through Duplicator's restore or recovery modes. The Pro takeover also needs a writable directory and the attacker reaching the setup page before the site owner does.
Update to 5.0.0, then rebuild old packages
Updating alone is not the whole fix. Packages created with an affected version keep the vulnerable installer they shipped with, and Wordfence found that Duplicator Pro 5.0.5's normal Import workflow still ran the older installer from a 4.6.10 package and triggered the bug. Wordfence advises site owners to:
- Update Duplicator and Duplicator Pro to 5.0.0 or later.
- Create a fresh package with the updated plugin before any migration or import, rather than reusing an old one, when practical.
- Remove publicly accessible standalone installer files that are no longer needed.
Disabling public comments removes the carrier Wordfence demonstrated, but it is not a substitute for updating, since other attacker-controlled database content may reach the same code. Wordfence Premium, Care and Response customers received a dedicated firewall rule on October 15, and free users get it on November 14. The flaw surfaced during a WordPress 7.1 security assessment, weeks after WordPress itself patched a core flaw that needs no login. The lesson is an old one that keeps biting: data that looked harmless when it arrived can still be dangerous when something trusted reads it later.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.