Technical impact
The vulnerability in the Duplicator WordPress plugin (versions prior to 5.0.0) allows an administrator of a multisite child site to execute arbitrary PHP code in the network‑wide plugin directory. The one‑click upgrade routine is exposed without proper user restrictions and can be invoked by any user who has the ability to install plugins. Because the upgrade action can run arbitrary PHP, the flaw results in remote code execution, compromising data confidentiality, integrity, and availability on the entire WordPress network.
Affected Systems
Any WordPress installation utilizing the Duplicator plugin before version 5.0.0 on a network of sites is affected. The vulnerability is specifically noted for Duplicator 1.5.17 and applies to all earlier releases of the plugin. Sites configured as multisite child sites, even when the network administrator role is not granted to the user, are vulnerable because they can trigger the exposed upgrade process.
Risk and Exploitability
The CVSS score of 7.2 indicates high severity due to its direct impact on remote code execution, and the EPSS score is < 1%, indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the unprotected one‑click upgrade endpoint, which does not require authentication and is accessible to any multisite site administrator. Because the code executed originates from the upgrade routine, an attacker could run arbitrary scripts, compromise the entire network, or deploy malware.
