437 matches found
Design/Logic Flaw
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating...
CVE-2022-2552 Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site...
CVE-2022-2552
The CVE-2022-2552 entry concerns the Duplicator WordPress plugin prior to 1.4.7.1. The primary issue is unauthenticated information disclosure: attackers can access server software, PHP version, and full filesystem path information via the installer/endpoints (e.g., the view parameter on the dupl...
CVE-2022-2551
CVE-2022-2551 affects WordPress Duplicator plugin versions prior to 1.4.7. The vulnerability is an authentication bypass that causes the plugin to disclose the backup URL to unauthenticated users who access the main installer endpoint, enabling download of the full site backup without authenticat...
CVE-2022-2551 Duplicator < 1.4.7 - Unauthenticated Backup Download
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating...
PT-2022-17348
Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 1.4.7 Description The issue concerns the lack of authentication or authorization for visitors, allowing them to view sensitive system information, including server software, PHP version, and the fu...
PT-2022-17339
Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 1.4.7 Description The issue allows unauthenticated visitors to access the main installer endpoint of the plugin and download the full site backup without authentication, if the installer script has...
WordPress Duplicator 1.4.7.1 Backup Disclosure
Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download Author: nu11secur1ty Date: 08.08.2022 Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/duplicator/ Reference:...
WordPress Duplicator 1.4.7.1 Plugin - Unauthenticated Backup Download Vulnerability
Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download Author: nu11secur1ty Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/duplicator/ Reference:...
WordPress Duplicator 1.4.7 Unauthenticated Backup Download
Title: WordPress Plugin Duplicator 1.4.7 - Unauthenticated Backup Download Author: nu11secur1ty Date: 08.03.2022 Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/duplicator/ Reference:...
WordPress Duplicator plugin <= 1.4.7 - Unauthenticated System Information Disclosure vulnerability
Unauthenticated System Information Disclosure vulnerability discovered by Ihsan Sencan in WordPress Duplicator plugin versions = 1.4.7. Solution Update the WordPress Duplicator plugin to the latest available version at least 1.4.7.1...
WordPress Duplicator plugin <= 1.4.6 - Unauthenticated Backup Download vulnerability
Unauthenticated Backup Download vulnerability discovered by Ihsan Sencan in WordPress Duplicator plugin versions = 1.4.6. Solution Update the WordPress Duplicator plugin to the latest available version at least 1.4.7...
WordPress plugin Duplicator 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure
The plugin does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. 1. curl 'http://example.com/wp-content/backups-dup-lite/dup-installer/main.installer.php?view=1' 2. curl -d view...
WordPress Duplicator 1.4.7 Plugin - Information Disclosure Vulnerability
Exploit Title: WordPress Plugin Duplicator 1.4.7 - Information Disclosure Exploit Author: SecuriTrust Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: = 1.4.7 Tested on: Linux, Windows CVE : CVE-2022-2552 Reference: https://securitrust.fr...
Duplicator < 1.4.7 - Unauthenticated Backup Download
The plugin discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating. PoC Find the URL of the actual installer...
Duplicator < 1.4.7 - Unauthenticated Backup Download
The plugin discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating. Find the URL of the actual installer scrip...
WordPress Duplicator 1.4.6 Backup Disclosure
Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download Google Dork: N/A Date: 07.27.2022 Exploit Author: SecuriTrust Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: 1.4.7 Tested on: Linux, Windows CVE :...
WordPress Duplicator 1.4.6 Plugin - Unauthenticated Backup Download Vulnerability
Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download Exploit Author: SecuriTrust Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: 1.4.7 Tested on: Linux, Windows CVE : CVE-2022-2551 Reference:...
WordPress Duplicator 1.4.7 Information Disclosure
Exploit Title: WordPress Plugin Duplicator 1.4.7 - Information Disclosure Google Dork: N/A Date: 07.27.2022 Exploit Author: SecuriTrust Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: = 1.4.7 Tested on: Linux, Windows CVE : CVE-2022-2552...