Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

WordPress security records

WordPress Vulnerability Listing

Filter Production Feed records and inspect affected software, version ranges, severity, patch information and source attribution without opening separate UUID pages.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

Clear filters

15 vulnerability records

MediumCVE-2024-6210

Duplicator <= 1.5.9 - Full Path Disclosure

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-1.5.9

Vulnerability type: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected software, patched versions and attribution

The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.5.9

Patched versions: 1.5.10

Researcher credit: stealthcopter

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 10, 2024
CVSS
5.3
MediumCVE-2023-51681

Duplicator <= 1.5.7 - Cross-Site Request Forgery via views/tools/diagnostics/information.php

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-1.5.7

Vulnerability type: CWE-352 Cross-Site Request Forgery (CSRF)

Affected software, patched versions and attribution

The Duplicator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.7. This is due to missing or incorrect nonce validation in the views/tools/diagnostics/information.php file. This makes it possible for unauthenticated attackers to remove some of the plugin's options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.5.7

Patched versions: 1.5.7.1

Researcher credit: Rafie Muhammad

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
December 27, 2023
CVSS
4.3
CriticalCVE-2018-25095

Duplicator < 1.3.0 - Unauthenticated Remote Code Execution

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: [*, 1.3.0)

Vulnerability type: CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected software, patched versions and attribution

The Duplicator – WordPress Migration & Backup Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 1.3.0 (exclusive) via the/installer.php file. This is due to plugin not properly cleaning up the installer.php file upon completion of the script. This makes it possible for unauthenticated attackers to execute code on the server.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: [*, 1.3.0)

Patched versions: 1.3.0

Researcher credit: Jeremy Lim

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
December 15, 2023
CVSS
9.8
CriticalCVE-2023-6114

Duplicator <= 1.5.7 AND Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Information Exposure

Duplicator Pro: Currently marked unpatchedDuplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: [*, 4.5.14.2); *-1.5.7

Vulnerability type: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected software, patched versions and attribution

Duplicator and Duplicator Pro for WordPress are vulnerable to Sensitive Information Exposure in various versions. This makes it possible for unauthenticated attackers to download sensitive information/files leading to the potential for a complete site takeover.

Duplicator Pro

Affected versions: [*, 4.5.14.2)

Patched versions: 4.5.14.2

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.5.7

Patched versions: 1.5.7.1

Researcher credit: Dmitrii Ignatyev

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
December 4, 2023
CVSS
9.8
HighCVE-2022-2552

Duplicator – WordPress Migration Plugin <= 1.4.7 - Sensitive Information Disclosure

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-1.4.7

Vulnerability type: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected software, patched versions and attribution

The Duplicator – WordPress Migration Plugin WordPress plugin is vulnerable to Unauthenticated System Information Disclosure in versions up to, and including, 1.4.7 via the 'view' or 'debug' parameter. This allows an unauthenticated attacker to obtain sensitive configuration information about the vulnerable system which includes details like PHP Version, Operating System, Full Path and more. This requires that the installer script has been run at least once by a site owner/administrator.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.4.7

Patched versions: 1.4.7.1

Researcher credit: SecuriTrust

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 27, 2022
CVSS
7.5
CriticalCVE-2022-2551

Duplicator – WordPress Migration Plugin <= 1.4.7 - Unauthenticated Backup Download

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-1.4.7

Vulnerability type: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected software, patched versions and attribution

The Duplicator WordPress Plugin is vulnerable to Unauthenticated Backup Download in versions up to, and including, 1.4.7 via the 'is_daws' parameter due to the fact that the source code of the response contains the randomized filename related to the back-up file that also exists in the same directory. This makes it possible for an unauthenticated attacker to download a full site backup which may contain sensitive information. This requires that the installer script has been run at least once by a site owner/administrator.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.4.7

Patched versions: 1.4.7.1

Researcher credit: SecuriTrust

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
July 27, 2022
CVSS
9.8
HighCVE-2020-11738

Duplicator < 1.3.28 - Directory Traversal

Duplicator Pro: Currently marked unpatchedDuplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: [*, 3.8.7.1); [*, 1.3.28)

Vulnerability type: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected software, patched versions and attribution

The Duplicator (Free & Pro) plugin for WordPress is vulnerable to Directory Traversal in versions up to 1.3.28 (and Duplicator Pro before 3.8.7.1) via the 'file' parameter through the duplicator_download() or duplicator_init() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Duplicator Pro

Affected versions: [*, 3.8.7.1)

Patched versions: 3.8.7.1

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: [*, 1.3.28)

Patched versions: 1.3.28

Researcher credit: nam3lum

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
February 28, 2020
CVSS
7.5
CriticalCVE-2018-17207

Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-1.2.40

Vulnerability type: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected software, patched versions and attribution

An issue was discovered in Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.2.40

Patched versions: 1.2.42

Researcher credit: Thomas Chauchefoin, Julien Legras

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
August 29, 2018
CVSS
9.8
MediumCVE-2018-7543

Duplicator <= 1.2.32 - Cross-Site Scripting

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-1.2.32

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.2.32

Patched versions: 1.2.33

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
March 15, 2018
CVSS
6.1
MediumCVE-2017-16815

Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-1.2.28

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-1.2.28

Patched versions: 1.2.30

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
November 7, 2017
CVSS
6.1
Medium

Duplicator < 1.1.4 - Cross-Site Request Forgery

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: [*, 1.1.4)

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Duplicator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the duplicator_package_build function. This makes it possible for unauthenticated attackers to create and download database and codebase backups via forged request granted they can trick an authenticated user into performing an action such as clicking on a link.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: [*, 1.1.4)

Patched versions: 1.1.4

Researcher credit: Ratiosec

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
February 9, 2016
CVSS
6.5
Medium

Duplicator <= 0.5.26 - Authenticated (Admin+) Cross-Site Scripting

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: [*, 0.5.28)

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Duplicator plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 0.5.26 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts that execute in a victim's browser.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: [*, 0.5.28)

Patched versions: 0.5.28

Researcher credit: Marcin Probola

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
August 15, 2015
CVSS
5.5
High

Duplicator <= 0.5.14 - SQL Injection

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-0.5.14

Vulnerability type: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected software, patched versions and attribution

The Duplicator plugin for WordPress is vulnerable to SQL Injection in versions up to and including 0.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-0.5.14

Patched versions: 0.5.16

Researcher credit: Claudio Viviani

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
April 10, 2015
CVSS
8.8
HighCVE-2014-9262

Duplicator < 0.5.10 - Arbitrary Backup Creation and Download

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: [*, 0.5.10)

Vulnerability type: CWE-287 Improper Authentication

Affected software, patched versions and attribution

The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: [*, 0.5.10)

Patched versions: 0.5.10

Researcher credit: Kacper Szurek

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
February 19, 2015
CVSS
8.2
MediumCVE-2013-4625

Duplicator – WordPress Migration Plugin <= 0.4.4 - Cross-Site Scripting

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Currently marked unpatched

Affected versions: *-0.4.4

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

Affected versions: *-0.4.4

Patched versions: 0.4.5

Researcher credit: High-Tech Bridge Security Research Lab

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
August 1, 2014
CVSS
6.1

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

Production Feed records are aggregated without claiming discovery, exploitation or infection. Applicable source notices remain attached to individual records. Read the methodology.