WordPress · Snap Creek Duplicator Plugin
CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
What it is
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
CISA: WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- April 13, 2020
- Severity
- High 7.5 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 98% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (5)
- https://snapcreek.com/duplicator/docs/changelog/?lite
- https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affe…
- https://cwe.mitre.org/data/definitions/23.html
- http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html
- http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html
More exploited flaws from WordPress
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 25, 2026 | Remote File Inclusion | Core | High 8.1 | 96% |
| Jul 21, 2026 | SQL Injection | Core | Medium 5.9 | 5.3% |
| Jul 21, 2026 | Interpretation Conflict | Core | Critical 9.8 | 11% |
| Nov 3, 2021 | Cross-Site Scripting (XSS) | Social Warfare Plugin | Medium 6.1 | 73% |
| Nov 3, 2021 | Remote Code Execution | File Manager Plugin | Critical 10.0 | 97% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.