Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-2551 — Forced Browsing in Duplicator

CWE-425 — Forced BrowsingCWE-416 — Use After Free7 documents7 sources
Severity
7.5HIGHNVD
CISA8.8
EPSS
59.7%
top 1.74%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Awesomemotive Duplicator
Timeline
PublishedAug 22
Latest updateAug 23

Description

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-7phj-wp5x-xwr5: The Duplicator WordPress plugin before 1↗2022-08-23
▶
CVEList
Duplicator < 1.4.7 - Unauthenticated Backup Download↗2022-08-22
▶
VulnCheck
awesomemotive duplicator Direct Request ('Forced Browsing')↗2022
▶

💥Exploits & PoCs

2
Exploit-DB
WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download↗2022-08-01
▶
Nuclei
WordPress Duplicator <1.4.7 - Authentication Bypass
▶

📋Vendor Advisories

1
CISA
Microsoft Internet Explorer Use-After-Free Vulnerability↗2022-03-28
▶
CVE-2022-2551 — Forced Browsing in Duplicator | cvebase