CVE-2022-2551

CVE-2022-2551: Duplicator < 1.4.7 - Unauthenticated Backup Download

Vendor Unknown

Product Duplicator – WordPress Migration Plugin

Weakness CWE-425 · Forced browsing

Published August 22, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

Key dates

02Disclosure timeline

August 22, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2551 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/425.html AskarLabs — CWE-425 write-up Direct Request ('Forced Browsing')

Related vulnerabilities

CVE-2022-2551: Duplicator < 1.4.7 - Unauthenticated Backup Download

01Description

02Disclosure timeline

03References

04Related CVE