CVE-2022-2551CWE-425

Duplicator < 1.4.7 - Unauthenticated Backup Download

published August 22, 2022

CVSS

—

EPSS

18%

Percentile

97.2

In the wild

Unconfirmed

What it is

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.17725 · 97.2th percentile
Weakness: CWE-425 · Direct Request ('Forced Browsing')
Published: 2022-08-22T15:03Z

EPSS history

Timeline

22 AUG 15:03Z
Duplicator < 1.4.7 - Unauthenticated Backup Download
cvelistv5