Duplicator WordPress plugin vulnerabilities

The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not restrict their database charset and collation rewrite to schema statements during a restore. A value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.

The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not prevent direct access to some bundled PHP files, which initialize without their expected context, trigger a fatal error, and return a stack trace disclosing the server's absolute filesystem paths to unauthenticated users.

The Duplicator and Duplicator Pro WordPress plugins before 5.1.0 do not sanitize and escape a parameter before reflecting it on one of their administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install plugins and exposes the routine without authentication. This allows an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory.