Duplicator Plugin Multisite Privilege Escalation Vulnerability

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-115251 is a critical privilege escalation vulnerability in the Duplicator WordPress plugin that allows child site administrators on multisite installations to execute arbitrary PHP code at the network level. The flaw stems from insufficient access controls on the plugin's one-click upgrade routine, which lacks both authentication checks and proper capability validation. This means a non-network administrator with only child site privileges can bypass security boundaries and inject malicious code into shared plugin directories accessible across the entire WordPress network. Organizations running WordPress multisite deployments with the Duplicator plugin are directly at risk, particularly those with multiple site administrators or hosting environments where trust boundaries between sites are critical security controls.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to identify exploitation patterns associated with TA0004 (Privilege Escalation) techniques. Practitioners using Casky would detect this attack chain through findings highlighting: improper capability checks on admin-facing AJAX or REST endpoints, unauthenticated file upload or code execution routines in plugin directories, inadequate multisite role validation that allows child site admins to perform network-level operations, and PHP execution in world-writable shared directories. The platform's MITRE ATT&CK alignment would surface specific detections for CWE-269 (Improper Access Control) patterns, including unauthorized administrative action execution and capability confusion between multisite role hierarchies. Security teams would see indicators such as unexpected administrative API calls from non-network accounts, file modifications in network-shared plugin paths, and PHP execution traces originating from child site contexts—enabling defenders to spot compromise attempts before arbitrary code reaches the network infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-115251.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-115251

Casky has 224 skills that investigate the attack patterns behind CVE-2026-115251. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn