CVEvulnerability

CVE-2020-11738

7.5 HIGH Known exploited Published 2020-04-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

WordPress Snap Creek Duplicator Plugin File Download Vulnerability — WordPress Snap Creek Duplicator Plugin

WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.

Added to KEV: 2021-11-03
Remediation due: 2022-05-03
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-11738

Status: Analyzed
Published: 2020-04-13
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0 ([email protected]): 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses: CWE-22

Description

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

Affected configurations

• awesomemotive duplicator (< 1.3.28) • awesomemotive duplicator (< 3.8.7.1)

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References