{"affected":[{"defaultStatus":"unaffected","product":"Duplicator","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.0","status":"affected","version":"5.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"duplicator-pro","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.0","status":"affected","version":"5.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-112244","cwes":["CWE-209"],"description":"The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/0c322135-f2a8-495d-986f-b9d626ddc856/"}],"kev":null,"metrics":[],"modifiedAt":1793772026085,"publishedAt":1793772026085,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/0c322135-f2a8-495d-986f-b9d626ddc856/"}],"remediation":[],"revision":"8f92d7d888dd61d6460303af8d10c9acfc3e482c9bd759b62e578bda2268f404","sources":[{"modifiedAt":1793772026085,"name":"CNA: WPScan","retrievedAt":1793776128214,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112244"}],"ssvc":null,"status":"published","title":"Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points","updatedAt":1793776128214}