CVE-2018-25095 is a critical code execution flaw, scored 9.8, in the Duplicator WordPress plugin before 1.3.0. It applies when the installer script is left on the site after use. Update to 1.3.0 or later and delete leftover installer files.
What's affected
- Product: Duplicator, the WordPress backup and migration plugin (Lite edition in the CPE).
- Affected: versions before 1.3.0.
- Fixed: 1.3.0, per WPScan, which lists it as the fixed in version.
- Condition: the installer script must still be present on the site after a migration or restore. Sites that removed it are not exposed through this path.
- Severity: 9.8 Critical (AV:N/AC:L/PR:N/UI:N). No CWE is assigned in the record.
How to check if you're exposed
- In the WordPress admin, open Plugins and read the Duplicator version. Anything below 1.3.0 is affected.
- From a shell,
wp plugin listprints every plugin with its version if you use WP-CLI, so filter the output for duplicator. - Look in the web root for leftover installer files, for example
ls -la installer*.phpin the directory that holds wp-config.php. - Check the web server access logs for requests to any installer file name outside the dates when you ran a migration.
What to do now
- Update Duplicator to 1.3.0 or later, or remove it if you do not use it.
- Delete installer.php, any installer backup copy and the archive files from the web root. They have no purpose once a migration is finished, and they contain site configuration.
- If an installer was exposed for any length of time, review the site for unfamiliar PHP files and review wp-config.php and the database credentials. Rotate the database password if there is any doubt.
- Make removal of installer files part of your migration checklist, and scan the web root for them on a schedule.
Why it matters
The plugin did not escape values properly when its installer script wrote them into WordPress configuration files. Input that reaches a configuration file without escaping can become code, and the installer script runs as the web server, so the code runs on the server. This is an injection class problem, but the record has no CWE for it.
The condition matters: the installer must still be on the site. That makes this a hygiene failure on top of a code defect, and it is why inventorying what is deployed in a web root is as useful as patching. The record's KEV flag is false, and the WPScan entry does not report exploitation in the wild. WPScan does publish proof of concept steps, which this post does not repeat.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
My site is already migrated. Am I safe?
Only if the installer files are gone and the plugin is updated. Check for both. An installer left behind is the condition the record describes.
Do I need to uninstall Duplicator?
No, version 1.3.0 or later contains the fix. If you only used it once for a migration, removing it is a reasonable way to shrink your plugin list.
Sources
- WPScan: Duplicator before 1.3.0, Unauthenticated RCE: Fixed version and the condition about the installer script.
Last reviewed: 19 October 2026.
