CVE-2018-25095

Duplicator < 1.3.0 - Unauthenticated RCE

The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.

Affected

Duplicator

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.92% chance of exploitation in the next 30 days, 60th percentile

Published

2024-01-08

Updated

2025-06-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/16cc47aa-cb31-4114-b014-7ac5fbc1d3ee

References

• CVE Record
• NVD entry