Exploit for Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure CVE-2023-6114

Name: Exploit for Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure CVE-2023-6114
Rating: 5 (103 reviews)

2023-12-04 | CVSS 5.0

## https://sploitus.com/exploit?id=WPEX-ID:5C5D41B9-1463-4A9B-862F-E9EE600EF8E1
1. Ensure that the web server (e.g. nginx or Apache) has directory listing enabled.
2. Visit Duplicator > Packages and click Create New and then Next.
3. Visit `/wp-content/backups-dup-lite/tmp/` to see the first sensitive files that are created.
4. Click Build.
5. Visit `/wp-content/backups-dup-lite/tmp/` to see database dump and the zip file as it is being assembled.

For the Pro version, change the paths above to use `backups-dup-pro`.