Duplicator vulnerabilities

2 known vulnerabilities in Duplicator from Awesomemotive. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Duplicator – WordPress Migration Plugin: Direct Request

  CVE-2022-2551Aug 22, 2022Duplicator – WordPress Migration PluginEPSS 18%

  The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site ba

• 7.5 High severity

  WordPress Snap Creek Duplicator Plugin File Download Exploited

  CVE-2020-11738Apr 13, 2020AwesomemotiveEPSS 97.8%

  The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.