Input validation vulnerability in Duplicator – WordPress Migration & Backup Plugin 1.5.7

The Duplicator plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery. Versions of the plugin up to and including 1.5.7 are affected by this. The vulnerability is due to the views/tools/diagnostics/information.php file not having enough security measures in place, which makes it possible for unauthenticated attackers to remove some of the plugin’s settings. An attack like this can be successful if the site administrator is tricked into performing an action such as clicking on a malicious link.