What’s Vulnerable › Vulnerabilities

CVE-2023-6114: Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 30.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-26 · updated 2026-06-17
• Weakness: CWE-552

Description

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.

Affected products

• Duplicator: before 1.5.7.1; before 4.5.14.2 — fixed in 1.5.7.1, 4.5.14.2

How to fix

Upgrade to a fixed version: Duplicator 1.5.7.1, 4.5.14.2. Check the vendor advisory for mitigations.

References

• https://drive.google.com/file/d/1mpapFCqfZLv__EAM7uivrrl2h55rpi1V/view?usp=sharing
• https://wpscan.com/vulnerability/5c5d41b9-1463-4a9b-862f-e9ee600ef8e1
• https://drive.google.com/file/d/1mpapFCqfZLv__EAM7uivrrl2h55rpi1V/view?usp=sharing
• https://wpscan.com/vulnerability/5c5d41b9-1463-4a9b-862f-e9ee600ef8e1

Get alerted when CVE-2023-6114 or the next vulnerability affects your stack