Description
WordPress Plugin Duplicator-WordPress Migration is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; subsequently, an attacker can generate and disclose the WordPress database and code backups. WordPress Plugin Duplicator-WordPress Migration version 1.1.2 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.1.4 or latest
References
http://www.ratiosec.com/2016/duplicator-wordpress-plugin-source-database-disclosure-via-csrf/
http://seclists.org/bugtraq/2016/Feb/83
http://www.securityfocus.com/archive/1/537506
http://lifeinthegrid.com/support/knowledgebase.php?article=20
Related Vulnerabilities
WordPress Plugin BulletProof Security Information Disclosure (5.1)
WordPress Plugin Fancy Comments WordPress Cross-Site Scripting (1.2.10)
Oracle JRE Improper Certificate Validation Vulnerability (CVE-2003-1229)
PHP Numeric Errors Vulnerability (CVE-2009-5016)
Liferay Portal Insecure Default Initialization of Resource Vulnerability (CVE-2025-43797)