CVE-2022-2551

PoC ×2—

CVSS 3.1

7.5 high

EPSS

17%p97

Published

Aug 22, 2022 (Aug 22, 2022)

Modified

Jun 17, 2026

Description

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

Vendors: awesomemotive
Products: duplicator
Ecosystems: WordPress
Weakness: CWE-425
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (16.7%)

In the news0 stories

No ingested article mentions this CVE yet.