Duplicator
Monthly
Privilege escalation in the Duplicator WordPress plugin before 5.0.0 lets an administrator of a WordPress Multisite child site who is not a network administrator use the plugin's one-click upgrade routine to install and execute arbitrary PHP in the network-wide shared plugin directory. The assessed vector requires high privileges (an existing subsite administrator account) and no user interaction; the description's additional claim that the routine is exposed without authentication is unresolved in the available data. No CISA KEV entry is present, a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.17% (percentile 7).
PHP object injection in Duplicator and Duplicator Pro allows unauthenticated attackers to plant a serialized object in public site content that is later deserialized when an administrator builds a package and then runs a migration or import with database search-and-replace. In Duplicator through 1.5.17 the bundled Requests 1.7 POP chain can escalate this to operating-system command execution; in Duplicator Pro through 4.6.10 the IndexList destructor gadget is limited to deleting an attacker-selected file when the containing directory is writable by the installer PHP process, with site takeover possible only through the additional wp-config.php deletion, race, and attacker-controlled database steps. This is a high-priority but heavily gated issue, and no public exploit identified at time of analysis.
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Snap Creek Duplicator before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Duplicator (free) and Duplicator Pro WordPress plugins before 5.1.0 allows an authenticated Subscriber to plant a crafted value in their own user profile that breaks out of its string literal and is injected into the restore's INSERT statement. The flaw is only reachable through a specific chain: an administrator must create a backup and later restore it onto a server that lacks one of the source server's charsets or collations, which is the condition that causes the plugin's charset/collation rewrite to spill past schema statements into data statements (CVSS 4.8, AC:H/PR:L/UI:R, integrity-only impact). No confirmed working exploit code is known - a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none and automatable as no, and EPSS is very low at 0.16% (6th percentile), so this is a this-month priority rather than an emergency.
Unauthenticated remote attackers can disclose a WordPress server's absolute filesystem paths by directly requesting PHP files bundled with Duplicator and Duplicator Pro 5.0.0 through 5.0.x, which fatal-error and return a stack trace when loaded outside their expected WordPress context. The issue is a low-severity information leak (CVSS 5.3, CWE-209) with no code execution, data modification, or denial of service; EPSS is 0.16% (5th percentile) and SSVC records no known exploitation, though a public PoC reference exists that is not verified as working exploit code. Vendor patches are available in 5.1.0 for both plugins.
Reflected cross-site scripting in Duplicator and Duplicator Pro WordPress plugins before 5.1.0 lets an attacker run script in a logged-in administrator's session when that administrator opens a crafted link, but only in certain unspecified plugin configurations. The issue requires administrator interaction and does not provide a silent attack path; EPSS is low at 0.16% (6th percentile), there is no CISA KEV entry, and SSVC exploitation is none. A public PoC reference exists, but it is not verified as working exploit code, and the vulnerability is prioritized as this_month.
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new". Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Privilege escalation in the Duplicator WordPress plugin before 5.0.0 lets an administrator of a WordPress Multisite child site who is not a network administrator use the plugin's one-click upgrade routine to install and execute arbitrary PHP in the network-wide shared plugin directory. The assessed vector requires high privileges (an existing subsite administrator account) and no user interaction; the description's additional claim that the routine is exposed without authentication is unresolved in the available data. No CISA KEV entry is present, a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.17% (percentile 7).
PHP object injection in Duplicator and Duplicator Pro allows unauthenticated attackers to plant a serialized object in public site content that is later deserialized when an administrator builds a package and then runs a migration or import with database search-and-replace. In Duplicator through 1.5.17 the bundled Requests 1.7 POP chain can escalate this to operating-system command execution; in Duplicator Pro through 4.6.10 the IndexList destructor gadget is limited to deleting an attacker-selected file when the containing directory is writable by the installer PHP process, with site takeover possible only through the additional wp-config.php deletion, race, and attacker-controlled database steps. This is a high-priority but heavily gated issue, and no public exploit identified at time of analysis.
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Snap Creek Duplicator before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Duplicator (free) and Duplicator Pro WordPress plugins before 5.1.0 allows an authenticated Subscriber to plant a crafted value in their own user profile that breaks out of its string literal and is injected into the restore's INSERT statement. The flaw is only reachable through a specific chain: an administrator must create a backup and later restore it onto a server that lacks one of the source server's charsets or collations, which is the condition that causes the plugin's charset/collation rewrite to spill past schema statements into data statements (CVSS 4.8, AC:H/PR:L/UI:R, integrity-only impact). No confirmed working exploit code is known - a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none and automatable as no, and EPSS is very low at 0.16% (6th percentile), so this is a this-month priority rather than an emergency.
Unauthenticated remote attackers can disclose a WordPress server's absolute filesystem paths by directly requesting PHP files bundled with Duplicator and Duplicator Pro 5.0.0 through 5.0.x, which fatal-error and return a stack trace when loaded outside their expected WordPress context. The issue is a low-severity information leak (CVSS 5.3, CWE-209) with no code execution, data modification, or denial of service; EPSS is 0.16% (5th percentile) and SSVC records no known exploitation, though a public PoC reference exists that is not verified as working exploit code. Vendor patches are available in 5.1.0 for both plugins.
Reflected cross-site scripting in Duplicator and Duplicator Pro WordPress plugins before 5.1.0 lets an attacker run script in a logged-in administrator's session when that administrator opens a crafted link, but only in certain unspecified plugin configurations. The issue requires administrator interaction and does not provide a silent attack path; EPSS is low at 0.16% (6th percentile), there is no CISA KEV entry, and SSVC exploitation is none. A public PoC reference exists, but it is not verified as working exploit code, and the vulnerability is prioritized as this_month.
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new". Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.