Product: Duplicator Pro
Vendor:  SnapCreek
Website: https://snapcreek.com/
Discovered by: Evolution Hosting
Version vulnerable: <= 1.3.14
Fixed in: 1.3.15+

Vulnerability Type:  Information Disclosure, local exposure of entire
webinstallation content

remotely triggerable: not for itself. Needs wp admin interaction.

O== Advise

Update to 1.3.15+ version

We did not test for a possible CSRF combination (i.e. with other plugins
) to lever it to a remote executable attack. Updating your Wordpress
Plugins regularly is a smart idea in general.

O== Timeline:

25.06.2019 - problem detected
26.06.2019 - vendor contacted
27.06.2019 - first vendor reaction
05.07.2019 - silent patched version made public by vendor
05.07.2019 - working fix confirmed
26.09.2019 - 90day timer run out

O== Description:

Duplicator( Pro ) can import/export/backup Wordpress installations.
While restoring the path after an import/restore, the directory mode of
the apphome is made public, if they were private before.

O== Tested Scenario:

OS:         Linux
Apache PHP: CGI with user privilege seperation
Docroot:    "/home/username/public_html/"

# ls -la /home/ | grep username
drwxr-x---    5 username webservices 4096 25. Jun 14:13 username

After Duplicator has done its import/restore:

drwxr-xr-x    5 username webservices 4096 25. Jun 14:17 username

which opens the home directory of this webapp for any other systemuser.
As fileaccessrules usually are relaxed inside a "home" directory, the
entire content along the installation path could be exposed, if the
pathpart was app owned.

This may include database credentials for wp and other apps for the same
user.

O== Temp Fix:

If you have a similar setup as our example above, execute after a restore:

chmod o-rx /home/username

O== Impact on none Linux systems

Unkown.