Old WordPress Plugin Being Exploited in RCE Attacks

Researchers are warning that attackers are abusing a vulnerability in WordPress site admins’ outdated versions of a migration plugin called Duplicator – allowing them to execute remote code. Made by Snap Creek Software, all Duplicator plugins earlier than version 1.2.42 are vulnerable to the...

CVE-2017-16815

The CVE-2017-16815 vulnerability affects the WordPress Duplicator plugin (installer.php) prior to 1.2.30, where unfiltered values in url_new and logging (installer/build/view.step4.php and installer/build/view.step2.php) enable cross-site scripting. This is an XSS in affected plugin versions (not...

CVE-2017-16815

installer.php in the Snap Creek Duplicator WordPress Site Migration & Backup plugin before 1.2.30 for WordPress has XSS because the values "urlnew" /wp-content/plugins/duplicator/installer/build/view.step4.php and "logging" wp-content/plugins/duplicator/installer/build/view.step2.php are not...