CVE-2026-112243 is a Reflected Cross-Site Scripting vulnerability in the Duplicator WordPress migration and backup plugin before version 5.1.0. An unauthenticated attacker can place HTML in the logname query parameter and send the link to an Administrator who can access Duplicator Tools. When the log list is empty, opening the link can execute JavaScript in that administrator’s browser session. The supplied test reproduced the issue on version 5.0.6. The vulnerability is fixed in 5.1.0.
| CVE | CVE-2026-112243 |
| Plugin Version | Duplicator < 5.1.0, fixed in 5.1.0 |
| All Time | 58 509 733 |
| Active installations | 1 000 000+ |
| Publicly Published | November 2, 2026 |
| Last Updated | November 5, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-79 Cross-Site Scripting |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-112243 https://www.wordfence.com/threat-intel/vulnerabilities/detail/duplicator-510-reflected-cross-site-scripting https://wpscan.com/vulnerability/402cdca7-e775-4895-808a-f161a7899114/ |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| October 21, 2026 | Plugin testing and vulnerability detection in Duplicator were completed. |
| October 21, 2026 | The vulnerability report was sent with the PoC, description, and recommendations for remediation. |
| November 2, 2026 | The vulnerability was publicly disclosed as CVE-2026-112243. |
| November 4, 2026 | The public CVE-2026-112243 record was published. |
Discovery of the Vulnerability
The affected page is the Logs tab under Duplicator Tools at /wp-admin/admin.php?page=duplicator-tools&tab=logs. In the 5.0.6 logs template, template/admin_pages/tools/duplicator_logs.php reads $_GET['logname'] at line 25. Lines 31-45 build an allowlist from the available log basenames, call validate_file(), and construct the selected log URL. At line 200, the page prints basename($logurl) directly into a div without HTML escaping.
The empty log list is the important precondition. WordPress Core validate_file() checks membership only when the supplied allowed-files array is nonempty. In the reported lab, the logs directory was absent and the plugin returned an empty list. The crafted value therefore survived this check and selected the log-display branch because it was nonempty. basename() extracts a path component but leaves the HTML payload executable when it is printed without esc_html().
Understanding of Reflected Cross-Site Scripting attacks
Reflected Cross-Site Scripting occurs when data supplied in a request is returned as executable page markup. Here, PHP decodes the logname query value, and the logs screen places the resulting image tag in its response. The injected onerror handler executes when the browser fails to load the image.
An attacker can construct the link without a WordPress account. Exploitation requires an authenticated Administrator to open it and have permission to access Duplicator Tools on a site with the affected configuration. The script then runs in the site origin within that browser session. This can expose information available to the victim and permit administrative requests within that account’s capabilities.
Exploiting the Reflected Cross-Site Scripting Vulnerability
The supplied PoC uses an alert to demonstrate script execution on a test installation. The attacker sends a crafted link to the administrator. Opening the link triggers the payload when the empty log-list condition is present.
POC:
POC: Attacker - unauthenticated Victim - Administrator with access to Duplicator Tools Tested version - Duplicator 5.0.6 Required configuration - logs directory unavailable and log list empty 1. Use a WordPress test installation matching the configuration above. 2. Sign in as an Administrator who can open the Duplicator Tools page. 3. Prepend the test site origin to this path and open it in that browser session. /wp-admin/admin.php?page=duplicator-tools&tab=logs&logname=%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E 4. Observe alert(document.domain) displaying the test site domain. 5. Inspect the HTTP 200 response and confirm that the supplied image tag is reflected as raw HTML.____
In the supplied lab result, the response returned HTTP 200 and contained the marker as raw HTML. Chrome displayed alert(document.domain) with 89.169.32.165. These observations demonstrate reflected script execution in the administrator browser under the reported configuration.
Recommendations for Improved Security
Update Duplicator to 5.1.0 or a newer patched release. The advisory also identifies Duplicator Pro before 5.1.0 as affected, so sites using that package should install its patched release. Administrators should treat unexpected links to plugin administration pages with caution, especially while an affected version remains installed.
Developers should require the selected log name to match an actual allowed entry and handle an empty log list explicitly. Escape the displayed name with esc_html() at the output boundary. The 5.1.0 logs template applies esc_html($logSelected) to the displayed value. Dynamic attributes and URLs also need escaping for their respective contexts, alongside capability checks on the administrative screen.
Addressing CVE-2026-112243 keeps a requested log name from becoming executable markup in an administrator browser. Explicit handling of an empty log list and correct output escaping protect this part of the backup workflow.
#WordPressSecurity #ReflectedXSS #Duplicator #PluginSecurity #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website.
