PT-2018-13948

Name of the Vulnerable Software and Affected Versions Snap Creek Duplicator versions prior to 1.2.42 Description An issue allows an attacker to inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution by accessing leftover installer files, specifically...

Snap Creek Duplicator RCE

The Snap Creek Duplicator plugin for Wordpress enables the possibility for code execution after a backup has been created. This affects versions prior to v1.2.42. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC reported: Details With over 1 million installations of this plugin in Wordpres...

Old WordPress Plugin Being Exploited in RCE Attacks

Researchers are warning that attackers are abusing a vulnerability in WordPress site admins’ outdated versions of a migration plugin called Duplicator – allowing them to execute remote code. Made by Snap Creek Software, all Duplicator plugins earlier than version 1.2.42 are vulnerable to the...

WordPress Duplicator Plugin Remote Code Execution

A Remote Code Execution vulnerability exists in the WordPress Duplicator Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Duplicator <= 1.2.40 - Unauthenticated Arbitrary Code Execution

If installer files, installer.php and installer-backup.php, are not removed by the administrators, a code injection during the database setup step allows to execute arbitrary code on the server. actionajax=3&actionstep=3&dbhost=nowhere&dbuser=test&dbpass=test&dbname=test';...

Duplicator <= 1.2.40 - Unauthenticated Arbitrary Code Execution

If installer files, installer.php and installer-backup.php, are not removed by the administrators, a code injection during the database setup step allows to execute arbitrary code on the server. PoC actionajax=3step=3=nowhere=test=test=test'; fileputcontents"test.php", ' '; /=12345&...

WordPress Duplicator plugin <= 1.2.40 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability found in WordPress Duplicator plugin versions = 1.2.40. Solution Update the WordPress Duplicator plugin to the latest available version at least 1.2.42...

WordPress Duplicator plugin <=1.2.32 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Duplicator plugin versions =1.2.32 Solution Update the WordPress Duplicator plugin to the latest available version at least 1.2.33...

CVE-2018-7543

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

CVE-2018-7543

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

CVE-2018-7543

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

CVE-2018-7543

CVE-2018-7543 is a cross-site scripting (XSS) vulnerability in the WordPress Duplicator plugin version 1.2.32. The issue lies in installer/build/view.step4.php where the json parameter can inject arbitrary JavaScript/HTML. Public references (Exploit-DB, PacketStorm, PatchStack) document a reflect...

PT-2018-18147

Name of the Vulnerable Software and Affected Versions SnapCreek Duplicator plugin version 1.2.32 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter in the...

WordPress Duplicator Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Duplicator plugin version 1.2.32, which can be exploited by an...

WordPress Duplicator 1.2.32 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting XSS Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://snapcreek.com/ Software Link:...

Duplicator <= 1.2.32 - Cross-Site Scripting (XSS)

The Duplicator – WordPress Migration Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting

WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://snapcreek.com/ Software Link:...

WordPress Duplicator 1.2.32 Cross Site Scripting

Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: 1.2.32 CV...

WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting

Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: 1.2.32 CV...