CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
Published Apr 13, 2020 · updated Jun 16, 2026 · awesomemotive duplicator
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Timeline
Detection, updates, and resolution for this record.
Apr 13, 2020 · Catalog
Detected
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe awesomemotive/duplicatorversion unspecified
- vendor WordPress Snap Creek Duplicator Pluginversion unspecified
Sources
- CISA KEVCVE-2020-11738
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
cisa.gov - CVE.orgCVE-2020-11738
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-11738
30-day exploitation probability 97.8%
first.org - Exploit Database50420
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_scanner/http/wp_duplicator_file_read
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-11738
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html
Packet Storm link already published on the finding.
packetstormsecurity.com