The Duplicator plugin registered its one-click upgrade AJAX endpoint for unauthenticated visitors and only required a low-privilege capability to use it. An attacker without an account could trigger the upgrade flow and make the site install and activate a malicious plugin package, leading to remote code execution and full site takeover.
This vulnerability affects the following application versions:
- Duplicator 1.5.5
- Duplicator 1.5.5.1
- Duplicator 1.5.6
- Duplicator 1.5.6.1
- Duplicator 1.5.7
- Duplicator 1.5.7.1
- Duplicator 1.5.8
- Duplicator 1.5.8.1
- Duplicator 1.5.9
- Duplicator 1.5.10
- Duplicator 1.5.10.1
- Duplicator 1.5.10.2
- Duplicator 1.5.11
- Duplicator 1.5.11.1
- Duplicator 1.5.11.2
- Duplicator 1.5.12
- Duplicator 1.5.13
- Duplicator 1.5.13.1
- Duplicator 1.5.13.2
- Duplicator 1.5.13.3
- Duplicator 1.5.14
- Duplicator 1.5.15
- Duplicator 1.5.16
- Duplicator 1.5.17