Duplicator

The Duplicator installer writes the database name, user, password, host and port, and the new site URL and paths submitted during the database/update steps into wp-config.php without escaping. An unauthenticated attacker who can reach a leftover installer.php or installer-backup.php can inject PHP code into wp-config.php and achieve remote code execution.

This vulnerability affects the following application versions:

• Duplicator 1.2.0
• Duplicator 1.2.2
• Duplicator 1.2.4
• Duplicator 1.2.6
• Duplicator 1.2.8
• Duplicator 1.2.10
• Duplicator 1.2.12
• Duplicator 1.2.14
• Duplicator 1.2.16
• Duplicator 1.2.18
• Duplicator 1.2.20
• Duplicator 1.2.22
• Duplicator 1.2.24
• Duplicator 1.2.26
• Duplicator 1.2.28
• Duplicator 1.2.30
• Duplicator 1.2.32
• Duplicator 1.2.34
• Duplicator 1.2.36
• Duplicator 1.2.38
• Duplicator 1.2.40
• Duplicator 1.2.42
• Duplicator 1.2.44
• Duplicator 1.2.46
• Duplicator 1.2.48
• Duplicator 1.2.50
• Duplicator 1.2.52

The Duplicator plugin registered its one-click upgrade AJAX endpoint for unauthenticated visitors and only required a low-privilege capability to use it. An attacker without an account could trigger the upgrade flow and make the site install and activate a malicious plugin package, leading to remote code execution and full site takeover.

This vulnerability affects the following application versions:

• Duplicator 1.5.5
• Duplicator 1.5.5.1
• Duplicator 1.5.6
• Duplicator 1.5.6.1
• Duplicator 1.5.7
• Duplicator 1.5.7.1
• Duplicator 1.5.8
• Duplicator 1.5.8.1
• Duplicator 1.5.9
• Duplicator 1.5.10
• Duplicator 1.5.10.1
• Duplicator 1.5.10.2
• Duplicator 1.5.11
• Duplicator 1.5.11.1
• Duplicator 1.5.11.2
• Duplicator 1.5.12
• Duplicator 1.5.13
• Duplicator 1.5.13.1
• Duplicator 1.5.13.2
• Duplicator 1.5.13.3
• Duplicator 1.5.14
• Duplicator 1.5.15
• Duplicator 1.5.16
• Duplicator 1.5.17

Unsafe filtering makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work.

This vulnerability affects the following application versions:

• Duplicator 1.3.0
• Duplicator 1.3.2
• Duplicator 1.3.4
• Duplicator 1.3.6
• Duplicator 1.3.8
• Duplicator 1.3.10
• Duplicator 1.3.12
• Duplicator 1.3.14
• Duplicator 1.3.16
• Duplicator 1.3.18
• Duplicator 1.3.20
• Duplicator 1.3.22
• Duplicator 1.3.24
• Duplicator 1.3.26
• Duplicator 1.3.28
• Duplicator 1.3.30
• Duplicator 1.3.32
• Duplicator 1.3.34
• Duplicator 1.3.36
• Duplicator 1.3.38
• Duplicator 1.3.40
• Duplicator 1.3.40.1
• Duplicator 1.4.0
• Duplicator 1.4.1
• Duplicator 1.4.2
• Duplicator 1.4.3
• Duplicator 1.4.4
• Duplicator 1.4.5
• Duplicator 1.4.6
• Duplicator 1.4.7
• Duplicator 1.4.7.1
• Duplicator 1.4.7.2
• Duplicator 1.5.0
• Duplicator 1.5.1
• Duplicator 1.5.2
• Duplicator 1.5.2.1
• Duplicator 1.5.3
• Duplicator 1.5.3.1
• Duplicator 1.5.4
• Duplicator 1.5.5
• Duplicator 1.5.5.1
• Duplicator 1.5.6
• Duplicator 1.5.6.1
• Duplicator 1.5.7
• Duplicator 1.5.7.1
• Duplicator 1.5.8
• Duplicator 1.5.8.1
• Duplicator 1.5.9

This patch introduces security enhancements to the Duplicator WordPress plugin by implementing hash checks in file paths to prevent arbitrary file downloads. Additionally, user interface improvements for email summaries and documentation links enhance user experience, ensuring that users have access to important resources and settings. From version 1.5.8 to version 1.5.11 (and intermediary versions). affected file: duplicator/template/admin_pages/settings/general/email_summary.php

This vulnerability affects the following application versions:

• Duplicator 1.5.6
• Duplicator 1.5.6.1
• Duplicator 1.5.7
• Duplicator 1.5.7.1
• Duplicator 1.5.8
• Duplicator 1.5.8.1
• Duplicator 1.5.9

The duplicator main packages table is not properly escaped to prevent any XSS attack.

This vulnerability affects the following application versions:

• Duplicator 1.2.12
• Duplicator 1.2.14
• Duplicator 1.2.16
• Duplicator 1.2.18
• Duplicator 1.2.20
• Duplicator 1.2.22
• Duplicator 1.2.24
• Duplicator 1.2.26
• Duplicator 1.2.28
• Duplicator 1.2.30
• Duplicator 1.2.32
• Duplicator 1.2.34
• Duplicator 1.2.36
• Duplicator 1.2.38
• Duplicator 1.2.40
• Duplicator 1.2.42
• Duplicator 1.2.44
• Duplicator 1.2.46
• Duplicator 1.2.48
• Duplicator 1.2.50
• Duplicator 1.2.52
• Duplicator 1.3.0
• Duplicator 1.3.2
• Duplicator 1.3.4
• Duplicator 1.3.6
• Duplicator 1.3.8
• Duplicator 1.3.10
• Duplicator 1.3.12
• Duplicator 1.3.14
• Duplicator 1.3.16
• Duplicator 1.3.18
• Duplicator 1.3.20
• Duplicator 1.3.22
• Duplicator 1.3.24
• Duplicator 1.3.26
• Duplicator 1.3.28
• Duplicator 1.3.30
• Duplicator 1.3.32
• Duplicator 1.3.34
• Duplicator 1.3.36
• Duplicator 1.3.38
• Duplicator 1.3.40
• Duplicator 1.3.40.1
• Duplicator 1.4.0
• Duplicator 1.4.1
• Duplicator 1.4.2
• Duplicator 1.4.3
• Duplicator 1.4.4
• Duplicator 1.4.5
• Duplicator 1.4.6
• Duplicator 1.4.7
• Duplicator 1.4.7.1
• Duplicator 1.4.7.2
• Duplicator 1.5.0
• Duplicator 1.5.1
• Duplicator 1.5.2
• Duplicator 1.5.2.1
• Duplicator 1.5.3
• Duplicator 1.5.3.1
• Duplicator 1.5.4
• Duplicator 1.5.5
• Duplicator 1.5.5.1
• Duplicator 1.5.6
• Duplicator 1.5.6.1
• Duplicator 1.5.7
• Duplicator 1.5.7.1
• Duplicator 1.5.8
• Duplicator 1.5.8.1

Escapes plugin url when enabling duplicator lite

This vulnerability affects the following application versions:

• Duplicator 1.5.0
• Duplicator 1.5.1
• Duplicator 1.5.2
• Duplicator 1.5.2.1
• Duplicator 1.5.3
• Duplicator 1.5.3.1
• Duplicator 1.5.4
• Duplicator 1.5.5
• Duplicator 1.5.5.1
• Duplicator 1.5.6
• Duplicator 1.5.6.1
• Duplicator 1.5.7
• Duplicator 1.5.7.1
• Duplicator 1.5.8
• Duplicator 1.5.8.1

An attacker could access files outside of Duplicator’s intended directory by submitting values like ../../../file.php to navigate throughout the server’s file structure.

This vulnerability affects the following application versions:

• Duplicator 1.3.24
• Duplicator 1.3.26