Duplicator EUVD-2026-116723

No authentication, user interaction, or special configuration is required: an unauthenticated remote attacker simply sends a direct HTTP request to specific PHP files bundled with Duplicator or Duplicator Pro that are designed to run within WordPress but, when accessed directly, initialise without their expected context. This affects default installations of the affected versions (Duplicator 5.0.0-5.0.x and Duplicator Pro 5.0.0-5.0.x, before 5.1.0). The main limiting factor is impact, not access: exploitation only yields disclosure of the server's absolute filesystem paths via the resulting PHP fatal-error stack trace - there is no code execution, data modification, or denial of service. Exploitability can also be reduced in deployments where PHP display_errors is disabled or where a WAF/hardening layer blocks direct access to plugin PHP files, since the leak depends on the stack trace being returned to the client.

This is a genuinely low-to-moderate priority issue despite its NETWORK/unauthenticated CVSS profile. The signals are internally consistent: CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) correctly reflects that any unauthenticated remote user can request the affected files, but the impact is capped at C:L/I:N/A:N - a single confidentiality loss (absolute filesystem path disclosure via a stack trace, CWE-209), with no integrity or availability impact. The low-impact nature is corroborated by SSVC (Technical Impact: partial, Exploitation: none) and by a very low EPSS of 0.16% (5th percentile), indicating no meaningful real-world exploitation pressure. The flaw is NOT in CISA KEV and SSVC Exploitation is 'none', so there is no evidence of active exploitation. SSVC does flag Automatable: yes, which is plausible because reaching the files requires only a predictable direct request - but automatability of a path-disclosure bug yields reconnaissance value, not direct compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the picture of a real but non-urgent informational-disclosure defect. The main value of the leaked data is as a stepping stone (absolute paths aid other attacks such as LFI/RFI or log poisoning), not as a standalone breach. No conflicting signals of note; the CVSS vector and the description agree that this is remote and unauthenticated.

An unauthenticated attacker directly requests one of Duplicator's bundled PHP files over HTTP; because the file initialises outside its expected WordPress context, PHP raises a fatal error and returns a stack trace containing the server's absolute filesystem paths. The attacker harvests these paths to map the installation and seed follow-on attacks (e.g. targeting LFI, log, or config locations). A public PoC reference exists (WPScan) but is not verified as working exploit code; attack complexity is low and no user interaction or authentication is needed.