A Vulnerability in WordPress Duplicator Plugin Could Allow for Arbitrary File Downloads
MS-ISAC ADVISORY NUMBER:2020-030
A vulnerability has been discovered in the WordPress Duplicator Plugin that could allow for Arbitrary File Downloads. WordPress is a web-based publishing application implemented in PHP, and the WordPress Duplicator Plugin helps site administrators migrate and copy WordPress sites. Successful exploitation of this vulnerability could allow for Arbitrary File Downloads.
There are reports that this vulnerability is being exploited in the wild.
- WordPress Duplicator Plugin prior to 1.3.28
- Large and medium government entities: HIGH
- Small government entities: MEDIUM
- Large and medium business entities: HIGH
- Small business entities: MEDIUM
A vulnerability has been discovered in the WordPress Duplicator Plugin that could allow for Arbitrary File Downloads. This vulnerability exists due to the way Duplicator handles certain requests from unauthenticated users. When an attacker sends a specially crafted request to Duplicator, an unauthenticated user can download arbitrary files from the target WordPress site. This includes the ‘wp-config.php’ file, which contains various site configurations, and potentially database credentials. Successful exploitation of this vulnerability could allow for Arbitrary File Downloads.
We recommend the following actions be taken:
- Apply appropriate updates provided for Duplicator to affected systems, immediately after appropriate testing.
- Apply the Principle of Least Privilege to all systems and services.
- Verify no unauthorized system modifications have occurred on system before applying patch.
- Monitor intrusion detection systems for any signs of anomalous activity.
- Unless required, limit external network access to affected products.