CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE

2024-01-0819:00:33

WPScan

www.cve.org

cve-2018-25095

duplicator wordpress plugin

unauthenticated rce

installer script

arbitrary code

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Duplicator",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.3.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]