Theme File Duplicator Vulnerabilities

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rockgod100 Theme File Duplicator allows Path Traversal. This issue affects Theme File Duplicator: from n/a through 1.3.

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Apr 17, 2025

CVE-2025-27283 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in rockgod100 Theme File Duplicator allows Using Malicious Files. This issue affects Theme File Duplicator: from n/a through 1.3.

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Apr 17, 2025

CVE-2025-27282 on NVD →

The Theme File Duplicator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which...

CVSS:

8.8

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Feb 21, 2025

CVE-2025-27282 on NVD →

The Theme File Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS:

6.5

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Feb 21, 2025

CVE-2025-27283 on NVD →