The vulnerability is a PHP Object Injection flaw that allows an unauthenticated attacker to store a serialized object in public site content. When an administrator later triggers a migration or import, the plugin deserializes this content and executes gadget chains. In the free version, a Requests‑1.7 pop‑chain runs attacker‑selected callbacks, yielding direct operating‑system command execution. In the Pro version, an IndexList destructor can delete chosen files such as wp‑config.php, exposing the setup wizard and facilitating a takeover if the attacker supplies a reachable, attacker‑controlled database before migration. The flaw therefore enables remote code execution or critical file tampering, compromising data confidentiality, integrity, and availability.

The affected products are the Duplicator and Duplicator Pro WordPress plugins. Duplicator versions up to and including 1.5.17 and Duplicator Pro versions up to and including 4.6.10 are vulnerable. These plugins are commonly used for creating backup packages, performing migrations, and managing site backups.

The CVSS score of 8.8 indicates a high severity, reflecting the remote code execution potential. The EPSS score is below 1 %, suggesting that while exploitation is possible, it is currently considered rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to embed a malicious serialized object in publicly accessible content and later have an administrator execute a migration or import. Once that condition is met, the gadget chains trigger command execution or file deletion, presenting a significant risk to affected sites.