CVE-2023-6114: awesomemotive duplicator

csirt@kutim:~/threat-intel/cve/CVE-2023-6114

CVSS 7.5 · High EPSS 30,9%

Kerentanan Files or Directories Accessible to External Parties pada awesomemotive duplicator. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.

Rincian

Terbit di NVD: 26 Desember 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-552: Files or Directories Accessible to External Parties
EPSS (30 hari): 30,9% peluang dieksploitasi; lebih tinggi dari 98,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
awesomemotive	duplicator	Semua versi sebelum 1.5.7.1
awesomemotive	duplicator	Semua versi sebelum 4.5.14.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://wpscan.com/vulnerability/5c5d41b9-1463-4a9b-862f-e9ee600ef8e1 exploit · advisory pihak ketiga
https://drive.google.com/file/d/1mpapFCqfZLv__EAM7uivrrl2h55rpi1V/view?usp=sharing exploit

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.