CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE
An attacker can execute arbitrary code on the server if the Duplicator installer script remains accessible, due to improper escaping of configuration values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25095?
CVE-2018-25095 is a critical code injection vulnerability in Unknown Duplicator, published on 8 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
Which versions are affected by CVE-2018-25095?
It affects 1 product.
Products include Awesomemotive Duplicator.
How do I fix CVE-2018-25095?
No fix has been published for CVE-2018-25095 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-25095 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25095 exists.
Other vulnerabilities in Unknown Duplicator
- CVE-2020-11738 WordPress Snap Creek Duplicator Plugin File Download
- CVE-2018-17207 Code injection in n/a
- CVE-2023-6114 Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
- CVE-2022-2551 Duplicator < 1.4.7 - Unauthenticated Backup Download
- CVE-2023-33309 WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-jp26-vw47-9r58.