PT-2022-17339 · WordPress · Duplicator

Ihsan Sencan · Published 2022-08-22 · Updated 2026-02-02 · CVE-2022-2551

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 1.4.7

Description The issue allows unauthenticated visitors to access the main installer endpoint of the plugin and download the full site backup without authentication, if the installer script has been run once by an administrator. This occurs because the plugin discloses the URL of the backup to unauthenticated visitors.

Recommendations For versions prior to 1.4.7, update to version 1.4.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the main installer endpoint of the plugin until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2022-2551

Affected Products

Duplicator

References · 6

• 🔥 https://github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2551 · Exploit
• 🔥 https://wpscan.com/vulnerability/f27d753e-861a-4d8d-9b9a-6c99a8a7ebe0 · Exploit
• 🔥 https://exploit-db.com/exploits/50992 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2551 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2551 · Vendor Advisory
• https://t.me/cveNotify/150570 · Telegram Post