Description
WordPress Plugin Duplicator-WordPress Migration is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; subsequently, an attacker can generate and disclose the WordPress database and code backups. WordPress Plugin Duplicator-WordPress Migration version 1.1.2 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.1.4 or latest
References
http://www.ratiosec.com/2016/duplicator-wordpress-plugin-source-database-disclosure-via-csrf/
http://seclists.org/bugtraq/2016/Feb/83
http://www.securityfocus.com/archive/1/537506
http://lifeinthegrid.com/support/knowledgebase.php?article=20
Related Vulnerabilities
Microsoft SQL Server Other Vulnerability (CVE-2000-0199)
Oracle Application Server CVE-2009-3412 Vulnerability (CVE-2009-3412)
MySQL CVE-2022-21607 Vulnerability (CVE-2022-21607)
phpMyAdmin Cleartext Storage of Sensitive Information Vulnerability (CVE-2008-1567)
WordPress Plugin WP w3all phpBB Multiple Unspecified Vulnerabilities (1.6.3)