CVE-2022-2551

Duplicator < 1.4.7 - Unauthenticated Backup Download

State: Published
Severity: Not scored
Published: Aug 22, 2022
Updated: Aug 3, 2024
Reserved: Jul 27, 2022

Description

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

Scores

The record has no CVSS score.

Weaknesses

CWE-425 Direct Request ('Forced Browsing')

Affected Products

Product	Versions
Duplicator – WordPress Migration PluginUnknown	1.4.7 to before 1.4.7Affected

References

https://wpscan.com/vulnerability/f27d753e-861a-4d8d-9b9a-6c99a8a7ebe0
https://github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2551

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.