~ / search / CVE-2026-112244

CVE-2026-112244

Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points

State: published CNA: WPScan CVSS 3.1 5.3 Medium NVD: deferred

Description

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.

Affected products

VendorProductVersions
n/a Duplicator 5.0.0 to <5.1.0
n/a duplicator-pro 5.0.0 to <5.1.0

References

External links from the record. They lead to third-party sites.