Duplicator WordPress plugin EUVD-2026-109353

Requires a WordPress Multisite deployment with Duplicator installed network-wide at a version from 1.5.17 up to (but not including) 5.0.0, and the attacker must already hold an administrator account on a child/subsite while NOT being a network administrator. The specific trigger is the plugin's one-click upgrade routine, which does not restrict the capability to users permitted to install the plugin. Limiting factors: exploitation is confined to WordPress Multisite configurations (single-site installs are not the described target), and per the CVSS vector it requires high privileges (an existing subsite admin account); however, the description's assertion that the routine is additionally exposed without authentication is unresolved and, if correct, would lower this barrier. No end-user interaction is required.

Signals are mostly aligned toward a moderate, not critical, priority. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N, i.e. network-reachable, low complexity, no user interaction, but requiring high privileges (an authenticated administrator account), which caps the realistic exposure. EPSS is low at 0.17% (7th percentile), consistent with the fact that exploitation needs an existing authenticated foothold rather than being broadly spray-able. This is NOT in CISA KEV, so there is no confirmed active exploitation, and the PoC is a WPScan reference that is not verified as working exploit code - these two facts should not be conflated. The vuln.today decision label is 'this_week', reflecting a real but non-emergency priority driven by the high technical impact (arbitrary PHP execution = full compromise) rather than by mass exploitability. One explicit conflict to verify with the vendor/WPScan: the CVSS vector encodes PR:H (authenticated), yet the description states the routine is 'additionally exposed without authentication' - if the unauthenticated-exposure claim is accurate, real-world privilege requirements may be lower than PR:H implies, which would raise priority. The described threat model (a multisite child-site administrator who is not a network administrator) is fundamentally a privilege-escalation/missing-authorization issue (CWE-269) scoped to WordPress Multisite deployments, which narrows the affected population.

On a WordPress Multisite install running Duplicator 1.5.17 up to before 5.0.0, a user who holds administrator on a single child site (but is not a network administrator) invokes the plugin's one-click upgrade routine, which fails to enforce the capability/authorization check. They point it at attacker-controlled content and write arbitrary PHP into the network-wide shared Duplicator directory, achieving code execution affecting the entire network. A public PoC reference exists via WPScan but is not verified as working exploit code.