CVE-2022-2552: The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server…

PriorityP344medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EXPLOIT

EPSS

8.42%

94.3th percentile

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
awesomemotive	duplicator	< 1.4.7.1	1.4.7.1

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://[PATH]/backups-dup-lite/dup-installer/main.installer.php↗

path/backups-dup-lite/dup-installer/main.installer.php↗

sigma

condition: and
- type: status
  status:
  - 200

→Detect unauthenticated GET requests to the Duplicator installer endpoint at /backups-dup-lite/dup-installer/main.installer.php — no authentication is required, so any external access to this path is suspicious. ↗
→Look for HTTP 200 responses to requests targeting main.installer.php combined with the presence of 'Setup Information' in the response body, indicating successful information disclosure.
→The 'view' parameter is used to trigger system information disclosure from the Duplicator installer endpoint. ↗

·Vulnerability affects Duplicator plugin versions before 1.4.7; the installer endpoint should not be publicly accessible on patched or properly configured installations. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.