Vulnerability record · CVE-2018-17207 · published 19 September 2018
CVE-2018-17207: WordPress Duplicator leftover installer files allow PHP code injection and RCE
Awesomemotive · Duplicator
Snap Creek Duplicator before 1.2.42 leaves installer.php and installer-backup.php accessible after installation. An attacker can reach those files and inject PHP code into wp-config.php during the database setup step, resulting in arbitrary code execution.
Description
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required and very high EPSS, so exploitation can lead to full site compromise.
What it is
Snap Creek Duplicator before 1.2.42 leaves installer.php and installer-backup.php accessible after installation. An attacker can reach those files and inject PHP code into wp-config.php during the database setup step, resulting in arbitrary code execution.
Impact
An unauthenticated attacker can execute arbitrary PHP code on the WordPress host, leading to full site compromise, data theft, and potential server takeover.
Attack surface
Reached over the network by requesting the leftover installer files directly; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is 0.60086 (99.09th percentile) and public exploit references exist, indicating high likelihood of exploitation.
What to do
- Upgrade Duplicator to 1.2.42 or later immediately.
- Delete or rename installer.php and installer-backup.php after completing any install or migration.
- Block direct web access to installer.php and installer-backup.php via web server rules.
- Audit wp-config.php and the web root for injected PHP code or unexpected modifications.
- If compromise is suspected, rotate WordPress salts, admin credentials, and any secrets stored on the host.
Detection
- Search web server logs for requests to installer.php or installer-backup.php.
- Monitor wp-config.php for unexpected modifications or PHP code outside the standard configuration.
- Look for new or modified PHP files in the WordPress root and uploads directories.
- Alert on POST requests to installer files with parameters associated with the database setup step.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://snapcreek.com/duplicator/docs/changelog/?lite | Vendor Advisory |
| https://www.synacktiv.com/ressources/advisories/WordPress_Duplicator-1.2.40-RCE.pdf | ExploitThird Party Advisory |
| https://snapcreek.com/duplicator/docs/changelog/?lite | Vendor Advisory |
| https://www.synacktiv.com/ressources/advisories/WordPress_Duplicator-1.2.40-RCE.pdf | ExploitThird Party Advisory |
Track CVE-2018-17207 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-17207), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
