The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Duplicator Plugin | — | Update duplicator plugin to version 1.3.0, or a newer patched version | May 15, 2025 | Dec 15, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub