{"id":"CVE-2026-112244","title":"Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points","summary":"The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and retu…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-209"],"product":"Duplicator","affected":["Duplicator >= 5.0.0 < 5.1.0","duplicator-pro >= 5.0.0 < 5.1.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-04T14:05:09.949572Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:21.436Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112244","references":[{"url":"https://wpscan.com/vulnerability/0c322135-f2a8-495d-986f-b9d626ddc856/"}],"tags":["cve.org"],"epss":0.00157,"epssPercentile":0.04846,"ingestedAt":"2026-11-05T21:36:00.369Z","slug":"CVE-2026-112244","body":"## Overview\n\nThe Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.\n\n## Affected\n\n- `Duplicator >= 5.0.0 < 5.1.0`\n- `duplicator-pro >= 5.0.0 < 5.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}