CVE-2022-2551
High
Description
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
SeverityHigh
CVSS7.5
Exploit probability—
ProductAwesomemotive Duplicator
PublishedAug 22, 2022
First seenAug 22, 2022
Weakness typeCWE-425CWE-425
How to fix
Update
- awesomemotive duplicator1.4.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| awesomemotive duplicator | v < 1.4.7 | 1.4.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.