CVE-2026-112244 PUBLISHED

Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points

Assigner: WPScan
Reserved: 19.10.2026 Published: 04.11.2026 Updated: 04.11.2026

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.

Product Status

Vendor Unknown
Product Duplicator
Versions Default: unaffected
  • affected from 5.0.0 to 5.1.0 (excl.)
Vendor Unknown
Product duplicator-pro
Versions Default: unaffected
  • affected from 5.0.0 to 5.1.0 (excl.)

Credits

  • Charles Vosburgh finder
  • WPScan coordinator

References

Problem Types

  • CWE-209 Information Exposure Through an Error Message CWE