徳丸氏の記事だけど参考にどうぞ
https://blog.tokumaru.org/2018/09/wordpress-duplicator-plugin-vulnerabilty.html