High severity7.5NVD Advisory· Published Dec 26, 2023· Updated Jun 17, 2026

CVE-2023-6114

Description

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory (or the backups-dup-pro/tmp directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Duplicator WordPress plugin, Duplicator Pro WordPress plugindescription
WordPress/Duplicatorllm-fuzzy
Range: <1.5.7.1
Package: https://wordpress.org/plugins/duplicator
WordPress/Duplicator Prollm-fuzzy
Range: <4.5.14.2

Patches

Vulnerability mechanics

References

drive.google.com/file/d/1mpapFCqfZLv__EAM7uivrrl2h55rpi1V/viewnvdExploit
wpscan.com/vulnerability/5c5d41b9-1463-4a9b-862f-e9ee600ef8e1nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.025
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000