{"uuid": "97a0dfbd-b4dc-41fc-b7c1-53b1d74972ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2551", "type": "seen", "source": "https://t.me/hacking_Attack/63907", "content": "Exploit Collector\nWordPress Duplicator 1.4.6 Backup Disclosure\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nWordPress Duplicator plugin versions 1.4.6 and below suffer from a backup disclosure vulnerability.\n\nSHA-256 | f52c96d84b29854a0f446a858b2b7641046268ef68ba2be7b21b09aeeced427a\n\nDownload\n# Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download\n# Google Dork: N/A\n# Date: 07.27.2022\n# Exploit Author: SecuriTrust\n# Vendor Homepage: https://snapcreek.com/\n# Software Link: https://wordpress.org/plugins/duplicator/\n# Version: < 1.4.7\n# Tested on: Linux, Windows\n# CVE : CVE-2022-2551\n# Reference: https://securitrust.fr\n# Reference: https://github.com/SecuriTrust/CVEsLab/CVE-2022-2551\n\n#Product:\nWordPress Plugin Duplicator < 1.4.7\n\n#Vulnerability:\n1-It allows an attacker to download the backup file.\n\n#Proof-Of-Concept:\n1-Backup download.\nThe backup file can be downloaded using the \"is_daws\" parameter.\nhttp://[PATH]/backups-dup-lite/dup-installer/main.installer.php\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:42.626321Z"}