Exploitation Summary
CVE-2022-2551 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including SecuriTrust. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates an unauthenticated backup download vulnerability in WordPress Plugin Duplicator versions prior to 1.4.7. The PoC shows how an attacker can download backup files by accessing a specific URL with the 'is_daws' parameter.
Description
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
Exploits (1)
This exploit demonstrates an unauthenticated backup download vulnerability in WordPress Plugin Duplicator versions prior to 1.4.7. The PoC shows how an attacker can download backup files by accessing a specific URL with the 'is_daws' parameter.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N