---
id: CVE-2026-112244
title: >-
  Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer
  Entry Points
summary: >-
  The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin
  before 5.1.0 does not prevent direct access to some of its bundled PHP files,
  which initialise without their expected context, trigger a fatal error, and
  retu…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-209
product: Duplicator
affected:
  - Duplicator >= 5.0.0 < 5.1.0
  - duplicator-pro >= 5.0.0 < 5.1.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T14:05:09.949572Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:21.436Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112244'
references:
  - url: 'https://wpscan.com/vulnerability/0c322135-f2a8-495d-986f-b9d626ddc856/'
tags:
  - cve.org
epss: 0.00157
epssPercentile: 0.04846
ingestedAt: '2026-11-05T21:36:00.369Z'
---

## Overview

The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.

## Affected

- `Duplicator >= 5.0.0 < 5.1.0`
- `duplicator-pro >= 5.0.0 < 5.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.