Read the docs

Awesomemotive

Records72All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9

Exploited now

Awesomemotive records in CISA KEV
TI-2020-09427 WordPress Snap Creek Duplicator Plugin File Download Vulnerability Priority CRITICAL 90KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records
Easy Digital Downloads 55 records HIGH Duplicator 8 records CRITICAL Wp Mail Logging 1 record LOW

Records

8 records in Duplicator · all components

TI-2018-15322 CVE-2018-25095 · GHSA-jp26-vw47-9r58

Duplicator < 1.3.0 - Unauthenticated RCE

Priority HIGH 82

The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00924 Published 2024-01-08 Fixed in 1.3.0
TI-2023-05620 CVE-2023-6114 · GHSA-769q-5ww3-v8ww

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

Priority MEDIUM 57

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version),…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.30894 Published 2023-12-26 Fixed in 1.5.7.1, 4.5.14.2 CWE-552
TI-2022-02356 CVE-2022-2551 · GHSA-7phj-wp5x-xwr5

Duplicator < 1.4.7 - Unauthenticated Backup Download

Priority MEDIUM 50

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrato…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18039 Published 2022-08-22 Fixed in 1.4.7 CWE-425
TI-2022-02357 CVE-2022-2552 · GHSA-g4pc-gj78-qfjj

Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure

Priority LOW 38

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.12247 Published 2022-08-22 Fixed in 1.4.7 CWE-306
TI-2018-05452 CVE-2018-7543 · GHSA-x5g3-xc68-hm4x

Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the…

Priority LOW 33

Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03349 Published 2018-03-26 No fix listed CWE-79
Open these records in search →