Executive Summary

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection. This vulnerability allows unauthenticated attackers to store a serialized object in public site content, which can lead to operating-system command execution or file deletion when an administrator performs a migration or import action. The severity of this vulnerability is rated at 8.8 CVSS score.

Technical Analysis

The vulnerability class is PHP Object Injection, which occurs via deserialization of untrusted database content in `DUPX_UpdateEngine::unserializeTest()` during migration. The attack vector involves storing a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. The root cause is the deserialization of untrusted data without proper validation.

How It Gets Exploited

An unauthenticated remote attacker can store a serialized object in public site content. When an administrator later builds a package and performs a migration or import, the serialized object is deserialized. For Duplicator Free, this can lead to direct operating-system command execution due to a bundled Requests 1.7 POP chain that permits attacker-selected callbacks. For Duplicator Pro, an attacker can delete an existing file by leveraging an IndexList destructor gadget, potentially exposing the setup wizard and leading to site takeover if `wp-config.php` is deleted.

Impact Assessment

The affected products and versions are Duplicator up to 1.5.17 and Duplicator Pro up to 4.6.10. An attacker can achieve operating-system command execution or file deletion, leading to potential site takeover. The CVSS score of 8.8 indicates a high severity level.

Recommended Actions

- Update Duplicator to version 1.5.18 or later. - Update Duplicator Pro to version 4.6.11 or later. - Monitor for any suspicious migration or import actions in your WordPress environment. - Implement a Web Application Firewall (WAF) rule to detect and block suspicious payloads.

Sources

- National Vulnerability Database (NVD) - Wordfence