CVE-2026-115262 Details
Description
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
A SQL injection vulnerability has been identified in the Duplicator and Duplicator-Pro WordPress plugins, both prior to version 5.1.0. The issue arises because the plugins do not properly limit the database charset and collation modifications to schema statements during the restoration process. As a result, a value stored by a Subscriber in their profile can escape its string literal and inject SQL into the INSERT statement of the restore. This exploitation occurs when an administrator restores the backup on a server that does not have one of the source's charsets or collations.
Users are advised to update to Duplicator version 5.1.0 or later, or Duplicator-Pro version 5.1.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/5359cd4c-9867-4b33-b0b2-ca85819f9af4/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Duplicator | < 5.1.0 (semver) |
CPE
Remediation
| |
| Duplicator Pro | < 5.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |