CVE-2018-17207: awesomemotive duplicator Code Injection
Vulnerability summary
CVE-2018-17207 is a critical (CVSS 9.8) Code Injection vulnerability in awesomemotive duplicator. EPSS estimates a 60.09% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 1.2.42.
Timeline
- 19-09-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
60.09%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 60.09% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (synacktiv.com)
Maturity: unknown
Snap Creek Duplicator WordPress plugin code injection
exploit/multi/php/wp_duplicator_code_inject
Maturity: poc
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Awesomemotive1 product
- duplicator< 1.2.42
Wordpress1 product
- duplicator≤ 1.2.40 (fixed in 1.2.42)
2 vendors · 2 products
References
3 links- www.synacktiv.com/ressources/advisories/WordPress_Duplicator-1.2.40-RCE.pdfX Refsource MISCExploitThird Party Advisory