WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution
Short Info
Level
Critical
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
25 days 1 hour
Scan only one
Domain, Subdomain, IPv4
Toolbox
-
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
References:
