CVE-2023-6114
High
Description
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
SeverityHigh
CVSS7.5
Exploit probability—
ProductAwesomemotive Duplicator
PublishedDec 26, 2023
First seenDec 26, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- awesomemotive duplicator1.5.7.1, 4.5.14.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| awesomemotive duplicator | v < 1.5.7.1, v < 4.5.14.2 | 1.5.7.1, 4.5.14.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.