Duplicator < 1.4.7 - Unauthenticated Backup Download

The plugin discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

PoC

Find the URL of the actual installer script in the html returned by this endpoint: http://example.com/wp-content/backups-dup-lite/dup-installer/main.installer.php?is_daws=1 By changing the last part of the URL from ‘_installer.php’ to ‘_archive.zip’ the full backup is available. As a bonus, by changing the last part of the URL from ‘_installer.php’ to ‘.log’, some information about the system is revealed.