CVE-2023-6114: Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
Vulnerability summary
CVE-2023-6114 is a critical (CVSS 9.8) vulnerability in awesomemotive duplicator. EPSS estimates a 30.89% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 1.5.7.1 and 4.5.14.2.
Timeline
- 26-12-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
30.89%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 30.89% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (drive.google.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Unknown2 products
- duplicator< 1.5.7.1
- duplicator pro< 4.5.14.2
Wordpress2 products
- duplicator≤ 1.5.7 (fixed in 1.5.7.1)
- duplicator-pro< 4.5.14.2
Awesomemotive1 product
- duplicator< 1.5.7.1 | < 4.5.14.2
3 vendors · 5 products
References
3 links- wpscan.com/vulnerability/5c5d41b9-1463-4a9b-862f-e9ee600ef8e1ExploitVDB EntryTechnical DescriptionThird Party Advisory