CVE-2022-2551 Duplicator < 1.4.7 - Unauthenticated Backup Download
Unauthenticated attackers can download full site backups if the installer was previously run, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2551?
CVE-2022-2551 is a high-severity vulnerability in Unknown Duplicator – WordPress Migration Plugin, published on 22 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
Weakness: CWE-425
Which versions are affected by CVE-2022-2551?
It affects 1 product.
Products include Awesomemotive Duplicator.
How do I fix CVE-2022-2551?
No fix has been published for CVE-2022-2551 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2551 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2551 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Unknown Duplicator – WordPress Migration Plugin
- CVE-2020-11738 WordPress Snap Creek Duplicator Plugin File Download
- CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE
- CVE-2018-17207 Code injection in n/a
- CVE-2023-6114 Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
- CVE-2023-33309 WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-7phj-wp5x-xwr5.