A dormant payload in a comment: the second-order flaw in Duplicator CVE-2026-82814

How a comment becomes a payload that activates during a site migration, and why replacing old backup archives is part of the fix.