Critical severity · published Jan 8, 2024
CVE-2018-25095
Duplicator < 1.3.0 - Unauthenticated RCE
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DU
Duplicator ·
before 1.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25095
Exploit
https://wpscan.com/vulnerability/16cc47aa-cb31-4114-b014-7ac5fbc1d3ee
More from Duplicator
7.5
CVE-2023-6114
Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
7.2
CVE-2026-115251
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade