Duplicator EUVD-2026-116730

Exploitation requires a specific chain rather than a default remote attack: (1) the attacker needs a low-privilege authenticated Subscriber account on the source site so they can store a malicious value in their own profile; (2) a site administrator must subsequently create a backup and perform a restore (the required user interaction); and (3) the destination server must lack one of the source server's charsets or collations, which is what causes the plugin's charset/collation rewrite to wrongly extend beyond schema statements into the INSERT statement. The vulnerability affects Duplicator (free) before 5.1.0 and Duplicator Pro 5.0.0 before 5.1.0. Limiting factors: authenticated Subscriber access, mandatory admin restore action, and the non-attacker-controlled charset/collation mismatch together make opportunistic or automated exploitation unlikely (reflected in SSVC Automatable: no and high attack complexity).

This is a genuine but comparatively low-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score is 4.8 (medium) with vector AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N: network-reachable but gated by high attack complexity, low-privilege (authenticated Subscriber) access, and required user interaction by an administrator. EPSS is very low at 0.16% (6th percentile), and CISA SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - all of which agree that this is not a mass-exploitable, drive-by flaw. It is not listed in CISA KEV, so there is no public evidence of active exploitation. A public PoC reference exists (WPScan); it is not verified as working exploit code. The vendor's priority label is 'this_month', not act_now/emergency, which matches the picture: a real integrity-affecting SQL injection worth patching on a normal cadence, not an incident-response emergency. The AC:H and UI:R metrics are well justified by the description - exploitation depends on an administrator restoring a backup onto a server that happens to lack one of the source's charsets/collations - so the raw network vector overstates practical reachability.

An attacker registers or already holds a low-privilege Subscriber account and stores a crafted value in their own profile that is designed to break out of a SQL string literal. When a site administrator later takes a backup and restores it onto a server missing one of the source's charsets or collations, the plugin's charset/collation rewrite misapplies to the INSERT statement and the attacker's profile value injects SQL during the restore. A public PoC reference exists but is not verified as working exploit code, and exploitation depends on the administrator-driven restore plus the charset mismatch.