Description
WordPress Plugin Duplicator-WordPress Migration is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; subsequently, an attacker can generate and disclose the WordPress database and code backups. WordPress Plugin Duplicator-WordPress Migration version 1.1.2 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.1.4 or latest
References
http://www.ratiosec.com/2016/duplicator-wordpress-plugin-source-database-disclosure-via-csrf/
http://seclists.org/bugtraq/2016/Feb/83
http://www.securityfocus.com/archive/1/537506
http://lifeinthegrid.com/support/knowledgebase.php?article=20
Related Vulnerabilities
WordPress Plugin Check & Log Email Cross-Site Scripting (1.0.3)
Drupal Core 8.5.x Cross-Site Scripting (8.5.0 - 8.5.1)
WordPress Plugin Buzzwords Cross-Site Scripting (1.1.0)
Joomla! Core 3.0.x Cross-Site Scripting (3.0.0 - 3.0.3)
WordPress Plugin NEX-Forms-The Ultimate WordPress Form Builder Security Bypass (7.8.7)