CVE-2026-115262 Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore

Description

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.

Exploitable remotely over the network, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

High

Privileges required

Low

Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected products and versions