CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
Description
CVE-2020-11738 is a high-severity path traversal vulnerability in the Snap Creek Duplicator plugin for WordPress (before version 1.3.28) and Duplicator Pro (before version 3.8.7.1). The vulnerability allows unauthenticated attackers to download arbitrary files from the WordPress server by exploiting directory traversal sequences (../) in the file parameter of the duplicator_download or duplicator_init endpoints. This CVE-2020-11738 vulnerability has been confirmed as actively exploited and is listed in CISA’s Known Exploited Vulnerabilities catalog. With a CVSS score of 7.5 (HIGH) and an EPSS score of 94.18% (99.9th percentile), this path traversal vulnerability affects over one million WordPress sites that use the Duplicator plugin.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| awesomemotive | duplicator | < 1.3.28; < 3.8.7.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html(Exploit, Third Party Advisory, VDB Entry)
- https://cwe.mitre.org/data/definitions/23.html(Not Applicable)
- https://snapcreek.com/duplicator/docs/changelog/?lite(Release Notes, Vendor Advisory)
- https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11738(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
The Snap Creek Duplicator plugin fails to properly validate and sanitize file path parameters in the duplicator_download and duplicator_init endpoints, allowing attackers to use directory traversal sequences such as "../" to escape the intended directory and access arbitrary files on the server. This path traversal weakness enables unauthenticated attackers to read sensitive configuration files, database credentials, and other critical data from the WordPress installation.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
Impact Analysis
CVE-2020-11738 carries a CVSS 3.1 score of 7.5 (HIGH), indicating a significant threat to affected WordPress installations. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any attacker. Confidentiality (High): attackers can read arbitrary files from the server, including wp-config.php containing database credentials, API keys, and authentication salts. The integrity and availability impacts are rated as none, as this is a read-only vulnerability. However, the information disclosed through file downloads—particularly database credentials and configuration secrets—can enable follow-on attacks with full system compromise. The EPSS score of 94.18% (99.9th percentile) indicates near-certain exploitation, reflecting the massive scale of active attacks observed against this vulnerability.
Exploit Maturity
CVE-2020-11738 has extensive public exploit availability and confirmed active exploitation at scale. Public exploit code is available via Packet Storm Security (directory traversal) and a second variant (arbitrary file read). CISA has confirmed active exploitation in the wild by including this vulnerability in the Known Exploited Vulnerabilities catalog. The EPSS score of 94.18% (99.9th percentile) indicates near-certain exploitation activity. Security researchers reported active attacks against over one million WordPress sites shortly after the vulnerability was disclosed, with attackers primarily targeting the wp-config.php file to steal database credentials.
Remediation
- Apply updates immediately as mandated by CISA KEV: Update Duplicator to version 1.3.28 or later, and Duplicator Pro to version 3.8.7.1 or later.
- After updating, immediately rotate all sensitive credentials that may have been exposed: WordPress database passwords, authentication keys and salts in wp-config.php, and any API keys or secrets stored in configuration files.
- Review web server access logs for suspicious requests containing "../" sequences targeting duplicator_download or duplicator_init endpoints. Any such requests indicate exploitation attempts and potentially successful data exfiltration.
- Implement a Web Application Firewall (WAF) with rules to block path traversal patterns (../) in request parameters. Restrict access to WordPress plugin directories and ensure the web server does not serve sensitive files outside the intended scope.
- As a long-term measure, audit all WordPress plugins for similar path traversal vulnerabilities. Implement file access controls that use canonical path resolution to verify requested files remain within allowed directories, and apply the principle of least privilege to the web server process.
Technical Details
CVE-2020-11738 is a directory traversal vulnerability (CWE-22) in the Snap Creek Duplicator plugin for WordPress. The duplicator_download and duplicator_init AJAX handlers accept a file parameter that is insufficiently validated, allowing attackers to inject "../" path traversal sequences to escape the intended directory and read arbitrary files from the server’s file system. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack requires no privileges and no user interaction, with a high confidentiality impact but no integrity or availability impact, as the vulnerability is limited to file reading. The attack targets WordPress’s AJAX handler (admin-ajax.php) with the duplicator_download action and a crafted file parameter, making exploitation straightforward with a single HTTP request.
Frequently Asked Questions
Is CVE-2020-11738 being actively exploited?
Yes. CVE-2020-11738 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.18% (99.9th percentile) indicates near-certain exploitation activity. Active attacks were observed targeting over one million WordPress sites using the Duplicator plugin.
What products are affected by CVE-2020-11738?
CVE-2020-11738 affects the Snap Creek Duplicator plugin for WordPress in versions before 1.3.28, and Duplicator Pro in versions before 3.8.7.1. The Duplicator plugin has over one million active installations, making this a high-impact vulnerability across the WordPress ecosystem.
How do I fix CVE-2020-11738?
Update Duplicator to version 1.3.28 or later, and Duplicator Pro to version 3.8.7.1 or later. After updating, rotate all credentials stored in wp-config.php, as they may have been exfiltrated. Review server logs for exploitation attempts. See the Remediation section for complete steps.
How severe is CVE-2020-11738?
CVE-2020-11738 has a CVSS 3.1 score of 7.5 (HIGH). While the direct impact is limited to arbitrary file reading, the exposed credentials (database passwords, API keys) can enable complete system compromise through follow-on attacks. With an EPSS score in the 99.9th percentile, this is one of the most actively exploited WordPress vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.