« Volver al listado

CVE-2022-2551

Estado: ModificadaAlta (7.5)—

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Awesomemotive — Duplicator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2551",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Duplicator – WordPress Migration Plugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.7",
              "lessThan": "1.4.7",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-22T15:15:15.317",
  "references": [
    {
      "url": "https://github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2551",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/f27d753e-861a-4d8d-9b9a-6c99a8a7ebe0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2551",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpscan.com/vulnerability/f27d753e-861a-4d8d-9b9a-6c99a8a7ebe0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating."
    },
    {
      "lang": "es",
      "value": "El plugin Duplicator de WordPress versiones anteriores a 1.4.7, divulga la url de la copia de seguridad a visitantes no autenticados que acceden al endpoint del instalador principal del plugin, si el script del instalador ha sido ejecutado una vez por un administrador, permitiendo la descarga de la copia de seguridad completa del sitio sin autenticarse."
    }
  ],
  "lastModified": "2026-06-17T04:42:06.270",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA1CF84E-14DC-4416-AA49-64E41A7746D4",
              "versionEndExcluding": "1.4.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}