Skip to content
Fencer Vulns
high 7.5

CVE-2022-2551 in the critical feed json

Duplicator < 1.4.7 - Unauthenticated Backup Download

published 2022-08-22 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-34805

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
18.0%
EPSS 18.0% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

Patch / fix

  • awesomemotive duplicator 1.4.7

Timeline

  1. First public exploit (EDB-50992)
  2. Published

Exploit prediction

18.04% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-50992 WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download webapps, 2022-08-01
  • Nuclei template WordPress Duplicator <1.4.7 - Authentication Bypass nuclei detection template
  • wpscan.com https://wpscan.com/vulnerability/f27d753e-861a-4d8d-9b9a-6c99a8a7ebe0 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/SecuriTrust/CVEsLab/tree/main/CVE-2022-2551 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Unknown Duplicator – WordPress Migration Plugin

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.