A WordPress comment can sit in the database doing nothing for weeks, and then execute during a routine site migration. That is the shape of a new Duplicator flaw: the payload arrives anonymously, waits, and only fires when an administrator moves the site with a backup package that was built after it landed.
What happened
Wordfence's research team found the issue on 30 August 2026 and published it as CVE-2026-82814 with a CVSS score of 8.8. The defect sits in Duplicator's migration engine, which passes database values to PHP's native unserialize() without restricting which classes may be created, so a stored value becomes a live object when a package is restored.
In Duplicator Free, the bundled Requests library gives the attacker a path to run an operating system command as the web server user. In Duplicator Pro, a different built-in class deletes a file of the attacker's choosing. Wordfence demonstrated deleting wp-config.php, which reopens the WordPress setup process and can lead to full site takeover if the attacker reaches it first and points the site at a database they control.
Who is affected
Duplicator has more than one million active installations, which makes this the widest-reach WordPress flaw of the week. Nothing about it requires an account on the site.
- Duplicator Free at version 1.5.17 or earlier, and Duplicator Pro at 4.6.10 or earlier.
- Sites with comments open, or with comments closed but pending spam still stored in the database. Pending comments count; approval is not needed.
- Anyone holding older migration packages built with an affected release, because those archives carry the vulnerable installer with them.
What to do now
Update Duplicator Free and Duplicator Pro to 5.0.0 or later, then rebuild any package you intend to restore from. Updating the plugin does not rewrite packages that already exist, so an old archive still ships old code.
- Update to 5.0.0 and confirm the version, then run a test package build to prove the new installer is what gets generated.
- Before your next migration or import, create a fresh package with the patched version instead of reusing a stored one.
- Remove standalone installer files left on the server after a migration. They are reachable by anyone who knows the path.
- Clear pending and spam comments you do not need, and review whether comment submission is required on pages that do not need it.
What this means for South African businesses
Migration is the moment a site is most fragile, and it is usually done at night by one person under time pressure, which is exactly when an old package gets reused. For an SME this matters because the payoff is not data theft but domain control: an attacker who owns the WordPress install also owns the mail that domain sends and the reputation attached to it.
There is no confirmed exploitation yet and no public proof of concept, so this is a fix-it-this-week item rather than a drop-everything item. My judgement is that the second-order design is what makes it dangerous: nothing looks wrong at the point of entry, so endpoint scanning and a glance at the comment queue will both come back clean.
Wordfence's technical write-up for CVE-2026-82814 is the primary source, available at wordfence.com.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.