CVE-2022-2552: vulnerability in Duplicator
Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 12%
from disclosure to weaponsame day
Published on NVDAug 22
1st PoCAug 1
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
Affected products
Unknown · Duplicatorpublic PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/50993cve_referencewpscan.com/vulnerability/6b540712-fda5-4be6-ae4b-bd30a9d9d698unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Duplicator
In the same product, most dangerous first.
CVE-2023-6114—Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data ExposureEPSS 30.9%CVE-2018-25095CRITICALDuplicator < 1.3.0 - Unauthenticated RCEEPSS 0.9%CVE-2026-115251HIGHDuplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click UpgradeEPSS 0.3%CVE-2026-112244MEDIUMDuplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry PointsEPSS 0.3%CVE-2026-115262MEDIUMDuplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During RestoreEPSS 0.2%CVE-2026-112243MEDIUMDuplicator < 5.1.0 - Reflected XSS via 'logname' ParameterEPSS 0.2%