# Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

Unauthenticated PHP object injection in Duplicator's migration unserializeTest() lets a stored comment trigger RCE (Free) or wp-config.php deletion leading to site takeover (Pro).

- Payout: Research
- Severity: high
- Program: Duplicator
- Found by (vendor credit): Alex Thomas, Wordfence Argus
- Write-up by: Alex Thomas
- Disclosed: 2026-10-20
- CVE: CVE-2026-82814
- Write-up quality: 8/10
- Original: https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-high-severity-unauthenticated-php-object-injection-in-duplicator/
- Library page: https://bugbountylibrary.com/r/blog%3Awordfence-com-blog-2026-10-wordfence-argus-discovers-high-severity-unauthenticated-php-object-injection-in-duplicator
- Tags: area:web domain:web impact:ato impact:rce kind:research platform:research sev:high tech:php tech:wordpress technique:second-order technique:source-review vuln:deserialization vuln:file-upload vuln:rce

**Target:** WordPress plugin migration installer (DUPX_UpdateEngine::unserializeTest)
**Root cause:** DUPX_UpdateEngine::unserializeTest() calls native unserialize() on attacker-influenced database content (including base64-decoded values) without allowed_classes restriction, instantiating attacker-named classes and running __wakeup/__destruct gadgets.
**Steps:**
1. Submit unauthenticated comment via `wp-comments-post.php` containing a base64-encoded serialized PHP object (no nonce/account needed; pending comments are stored).
2. Administrator creates a Duplicator package including the comment.
3. Administrator runs a standard migration/import; installer's Update Data search-and-replace decodes base64 and calls `@unserialize($data)`.
4. Free: chain `DbUserMode::__wakeup()` + `Requests_Utility_FilteredIterator` with callback `system` and command arg -> OS command execution.
5. Pro: `Duplicator\Libs\Index\IndexList::__destruct()` unlinks `$this->path` -> delete `wp-config.php`.
6. Pro takeover: reach WordPress setup wizard first, point to attacker-controlled DB, create admin, install PoC plugin -> PHP code execution.
**How found:** Wordfence Argus traced attacker-controlled data beyond the storing request into a later admin-driven migration, spotting that the migration engine base64-decodes and unserializes database values; then enumerated bundled classes for usable __wakeup/__destruct gadgets per edition.
**Exploitation:** Attacker stores serialized object in a public comment; after admin builds a package and performs a standard migration, the installer deserializes it. Free yields direct OS command execution as web-server user; Pro deletes wp-config.php, exposing setup wizard which attacker completes with their own database to gain admin and code execution.
**Escalation:** Pro path chains arbitrary file deletion of wp-config.php into setup-wizard hijack, admin creation, and plugin-based PHP execution; Free path chains two bundled classes into system() call.
**Insight:** Second-order sinks: data stored harmlessly by an unauthenticated endpoint can be re-parsed by a privileged later workflow (backup/migration search-and-replace). Grep migration/import engines for unserialize() on DB content and check base64-decode-then-unserialize paths; enumerate bundled library classes (Requests, IndexList) for gadget chains per edition.