CVE-2026-112244 Details
Description
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
A full path disclosure vulnerability has been identified in the Duplicator and Duplicator-Pro WordPress plugins, both of which are affected in versions prior to 5.1.0. The vulnerability arises because the plugins do not restrict direct access to certain bundled PHP files. This lack of restriction allows the files to be accessed without the necessary context, leading to a fatal error. The error response includes a stack trace that reveals the server's absolute filesystem paths to unauthenticated users.
Users are advised to update to Duplicator WordPress plugin version 5.1.0 or later. For the Duplicator-Pro WordPress plugin, version 5.1.0 or later should be installed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/0c322135-f2a8-495d-986f-b9d626ddc856/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Duplicator | >= 5.0.0, <= 5.0.6 (semver) |
CPE
Remediation
| |
| Duplicator Pro | >= 5.0.0, <= 5.0.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |