WordPress duplicator has 8 known advisories in the phpwarden feed, 1 actively exploited. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-11738 KEV | The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the f | high | 7.5 | <1.3.28 or <3.8.7.1 | 3.8.7.1 |
| CVE-2023-6114 | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-l | high | 7.5 | <1.5.7.1 or <4.5.14.2 | 4.5.14.2 |
| CVE-2022-2551 | The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endp | high | 7.5 | <1.4.7 | 1.4.7 |
| CVE-2022-2552 | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such | medium | 5.3 | <1.4.7.1 | 1.4.7.1 |
| CVE-2014-9262 | The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. | high | 8.2 | <=0.5.8 | – |
| CVE-2018-7543 | Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows re | medium | 6.1 | =1.2.32 | – |
| CVE-2017-16815 | installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values | medium | 6.1 | =1.2.28 | – |
| CVE-2018-25095 | The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configur | critical | 9.8 | <1.3.0 | 1.3.0 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked