CVE-2022-2551

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-425

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-255108.8FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escal CVE-2022-255116.5An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anyw CVE-2022-255127.5FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.CVE-2022-255147.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has d CVE-2022-255156.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has di CVE-2022-255166.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third part CVE-2022-255179.8MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.jav CVE-2022-255186.5In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to re CVE-2022-25525.3The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such CVE-2022-255219.8NUUO v03.11.00 was discovered to contain access control issue.CVE-2022-255238.8TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.CVE-2022-25536.5The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a resul