漏洞描述
WordPress Duplicator plugin before 1.4.7 is susceptible to authentication bypass. The plugin discloses the URL of the backup to unauthenticated visitors accessing the main installer endpoint. If the installer script has been run once by an administrator, this allows download of the full site backup without proper authentication.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wpscan.comhttps://wpscan.com/vulnerability/f27d753e-861a-4d8d-9b9a-6c99a8a7ebe0↗wordpress.orghttps://wordpress.org/plugins/duplicator/↗github.comhttps://github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2551↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-2551↗github.comhttps://github.com/ARPSyndicate/cvemon↗