{"affected":[{"defaultStatus":"unaffected","product":"Duplicator","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"duplicator-pro","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.1.0","status":"affected","version":"5.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-115262","cwes":["CWE-89"],"description":"The Duplicator  WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/5359cd4c-9867-4b33-b0b2-ca85819f9af4/"}],"kev":null,"metrics":[],"modifiedAt":1793772027374,"publishedAt":1793772027374,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/5359cd4c-9867-4b33-b0b2-ca85819f9af4/"}],"remediation":[],"revision":"51e679cd1d5fbeda6f12f78d703162611255fbfcea5d624a9a9d7332da53c778","sources":[{"modifiedAt":1793772027374,"name":"CNA: WPScan","retrievedAt":1793776136167,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115262"}],"ssvc":null,"status":"published","title":"Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore","updatedAt":1793776136167}