High severity7.5NVD Advisory· Published Aug 22, 2022· Updated Jun 17, 2026

CVE-2022-2551

Description

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Duplicatorcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.4.7
Package: https://wordpress.org/plugins/duplicator

Patches

Vulnerability mechanics

References

github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2551nvdExploitThird Party Advisory
wpscan.com/vulnerability/f27d753e-861a-4d8d-9b9a-6c99a8a7ebe0nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.010
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000