Duplicator
Approved changes feed: RSS · Atom
cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*
part: a version: * update: *
| Vendor | Awesomemotive (d2bec866-30ad-5b83-8073-4fd5afcb6449) |
|---|---|
| Product | Duplicator (09cd3997-e8bb-56c0-bfb7-652a9482d94a) |
| Edition | * |
| Language | * |
| Software edition | lite |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-2552 |
vulnerable | 2026-06-08 05:43:35.788555 |
Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
Published: 2022-08-22T15:04:02.000Z
Updated: 2024-08-03T00:39:08.064Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2551 |
vulnerable | 2026-06-08 05:43:35.786851 |
Duplicator < 1.4.7 - Unauthenticated Backup Download
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
Published: 2022-08-22T15:03:52.000Z
Updated: 2024-08-03T00:39:08.049Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11738 |
vulnerable | 2026-06-08 05:17:54.252113 |
Details available
HIGH (7.5)
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
Published: 2020-04-13T21:20:00.000Z
Updated: 2026-01-12T20:20:55.122Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25095 |
vulnerable | 2026-06-08 05:11:29.359028 |
Duplicator < 1.3.0 - Unauthenticated RCE
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
Published: 2024-01-08T19:00:33.155Z
Updated: 2025-06-03T14:34:46.451Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-17207 |
vulnerable | 2026-06-08 05:11:06.166387 |
Details available
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
Published: 2018-09-19T16:00:00.000Z
Updated: 2024-09-17T03:59:04.103Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.