CVE-2022-2551
Published: 22 August 2022
Summary
CVE-2022-2551 is a high-severity Forced Browsing (CWE-425) vulnerability in Awesomemotive Duplicator. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Duplicator WordPress plugin before version 1.4.7 is affected by an information disclosure vulnerability (CWE-425) that exposes the URL of a site backup. When the plugin's installer script has been executed at least once by an administrator, unauthenticated visitors who reach the main installer endpoint can retrieve this URL and obtain the full backup archive without any authentication.
An attacker with network access can exploit the flaw simply by requesting the installer endpoint, retrieving the disclosed backup URL, and downloading the complete site contents. The issue carries a CVSS 3.1 score of 7.5, reflecting high confidentiality impact with no required privileges or user interaction.
Public references, including WPScan and a GitHub repository containing proof-of-concept material, document the vulnerability and point to the availability of an updated plugin release that addresses the exposure. The associated EPSS score has remained in the 0.6 range with a modest peak of 0.6481 and does not indicate a pronounced post-disclosure increase in exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34805
Vulnerability details
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full…
more
site backup without authenticating.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Forcing a decision on every access request, including direct ones, reduces the exploitability of forced browsing by ensuring no unchecked access paths.
Forces all accesses through the reference monitor, preventing direct or forced requests that bypass checks.
Enforcing access for all logical requests prevents unauthorized direct access to protected resources.
Displaying the notification before further access on public systems prevents direct resource requests from bypassing the required system use terms and consent.
Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.
Blocks unauthorized direct requests or forced browsing by denying input access to non-authorized actors.