How severe is CVE-2018-25095?

CVE-2018-25095 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-25095 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-25095?

CVE-2018-25095 affects Awesomemotive Duplicator. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-25095?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2018-25095 have an EU (EUVD) identifier?

Yes. CVE-2018-25095 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2018-13847.

When was CVE-2018-25095 published?

CVE-2018-25095 was published on 2024-01-08 and last updated on 2026-06-17.

CVE-2018-25095

CVE-2018-25095 is a critical-severity vulnerability in Awesomemotive Duplicator with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2018-13847
Affected product: Awesomemotive Duplicator
Published: 2024-01-08
Last modified: 2026-06-17

Description

The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.

Frequently asked questions

What is CVE-2018-25095?: The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
How severe is CVE-2018-25095?: CVE-2018-25095 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-25095 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-25095?: CVE-2018-25095 affects Awesomemotive Duplicator. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-25095?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2018-25095 have an EU (EUVD) identifier?: Yes. CVE-2018-25095 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2018-13847.
When was CVE-2018-25095 published?: CVE-2018-25095 was published on 2024-01-08 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/16cc47aa-cb31-4114-b014-7ac5fbc1d3ee

Affected products (1)

cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*

More vulnerabilities in Awesomemotive Duplicator

CVE-2018-17207 — Critical (CVSS 9.8): An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php…
CVE-2023-6114 — High (CVSS 7.5): The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow…
CVE-2022-2551 — High (CVSS 7.5): The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing…
CVE-2020-11738 — High (CVSS 7.5): The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory…
CVE-2023-33309 — High (CVSS 7.1): Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.
CVE-2018-7543 — Medium (CVSS 6.1): Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32…

All CVEs affecting Awesomemotive Duplicator →