CVE-2022-2551

HighPublished

Duplicator < 1.4.7 - Unauthenticated Backup Download

Published: Aug 22, 2022
Updated: Aug 3, 2024
Assigning CNA: WPScan
Evidence observed: Aug 1, 2022

Primary CVSS

7.5/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability estimate

17.7%

Moderate · next 30 days

Percentile: 97.1%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

WordPress Duplicator <1.4.7 - Authentication BypassTemplate
http/cves/2022/CVE-2022-2551.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)

WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup DownloadExploit
SecuriTrust · php · Aug 1, 2022

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.