Duplicator EUVD-2026-107032

Exploitation requires (1) an unauthenticated attacker to store a serialized PHP object in public site content, (2) an administrator to build a Duplicator/Duplicator Pro package AFTER that carrier is already present, and (3) that administrator to subsequently perform a migration or import that runs database search-and-replace, which invokes DUPX_UpdateEngine::unserializeTest(). For Duplicator Free the bundled Requests 1.7 POP chain yields direct OS command execution. For Duplicator Pro the IndexList destructor gadget only enables deletion of an attacker-chosen existing file AND only when the containing directory is writable by the installer PHP process; full takeover additionally requires deleting wp-config.php, winning a race to reach the exposed setup wizard before legitimate users, and supplying an attacker-controlled reachable database. Limiting factors: mandatory administrator migration action (UI:R), strict ordering (carrier stored before package creation), and for Pro a writable-directory precondition plus a timing/race dependency - these materially reduce opportunistic mass exploitation.

This is a genuine high-priority issue rather than a merely high-CVSS paper risk, but with important real-world gating. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) signals network-reachable, low-complexity, unauthenticated payload storage leading to full confidentiality/integrity/availability loss - and the Duplicator Free variant chains to direct OS command execution via a bundled Requests 1.7 POP gadget, which is the most severe outcome. However, the vector's AC:L understates the real exploitation sequence: the attacker must plant a serialized carrier in public content BEFORE an administrator builds a package, and an administrator must later run a migration/import with database search-and-replace (reflected by UI:R). For Duplicator Pro the outcome is weaker (an IndexList destructor gadget enabling attacker-selected file deletion, dependent on a writable installer directory and winning a race to reach the exposed setup wizard first), so Free and Pro do not carry identical practical risk. No EPSS score was supplied and there is no CISA KEV listing or public POC reference in the input, so exploitation status is: no public exploit identified at time of analysis. Net: treat as a priority patch given the large install base and RCE potential on the Free edition, while recognizing that successful exploitation depends on administrator migration actions and (for Pro) timing/configuration conditions not fully in the attacker's control.

An unauthenticated attacker posts content containing a crafted serialized PHP object into a publicly writable area of a WordPress site running Duplicator or Duplicator Pro. A site administrator later builds a migration package and runs a migration or import that executes database search-and-replace, causing DUPX_UpdateEngine::unserializeTest() to deserialize the attacker's object; on Duplicator Free the bundled Requests 1.7 POP chain then invokes an attacker-selected callback for direct OS command execution, while on Pro the IndexList destructor can delete wp-config.php to expose the setup wizard. No public exploit code is identified in the provided data, but the Requests library POP chain is a well-known gadget class.