Duplicator Backups Migration Plugin Cloud Backups Scheduled Backups More
Monthly
PHP object injection in Duplicator and Duplicator Pro allows unauthenticated attackers to plant a serialized object in public site content that is later deserialized when an administrator builds a package and then runs a migration or import with database search-and-replace. In Duplicator through 1.5.17 the bundled Requests 1.7 POP chain can escalate this to operating-system command execution; in Duplicator Pro through 4.6.10 the IndexList destructor gadget is limited to deleting an attacker-selected file when the containing directory is writable by the installer PHP process, with site takeover possible only through the additional wp-config.php deletion, race, and attacker-controlled database steps. This is a high-priority but heavily gated issue, and no public exploit identified at time of analysis.
PHP object injection in Duplicator and Duplicator Pro allows unauthenticated attackers to plant a serialized object in public site content that is later deserialized when an administrator builds a package and then runs a migration or import with database search-and-replace. In Duplicator through 1.5.17 the bundled Requests 1.7 POP chain can escalate this to operating-system command execution; in Duplicator Pro through 4.6.10 the IndexList destructor gadget is limited to deleting an attacker-selected file when the containing directory is writable by the installer PHP process, with site takeover possible only through the additional wp-config.php deletion, race, and attacker-controlled database steps. This is a high-priority but heavily gated issue, and no public exploit identified at time of analysis.