CVE-2014-9262 Duplicator < 0.5.10 - Arbitrary Backup Creation and Download

HighCVSS 8.2 EPSS 7.5% Public exploit

Published: 2017-08-07 20:00
Updated: 2026-06-17 03:18
Exploit status: Public exploit available

Sign in for asset impact Search another CVE

Description

The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.

Affected products

Product	Affected versions	Fixed in
snapcreek duplicator	<= 0.5.8	No fix listed
wordpress duplicator(WordPress)	< 0.5.10	0.5.10

References

36112 exploit third-party-advisory vdb-entry
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v3.0

8.2 High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: None

All scores (3)

v3.1 8.2 · wordfence
v3.0 8.2 · nvd@nist.gov
v2.0 5.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 7.49% (percentile 94.6)
CWE: CWE-264 CWE-287 Improper Authentication

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

WordPress Plugin Duplicator 0.5.8 - Privilege Escalation Exploit · Exploit Database (OffSec) · 2015-02-18