7.5High KEV

CVE-2020-11738WordPress Snap Creek Duplicator Plugin File Download Vulnerability

awesomemotive duplicator Published: 2020-04-14 00:20 (6 years ago)

Known exploited — WordPress Snap Creek Duplicator Plugin File Download Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-11738

Description

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
awesomemotive	duplicator	< 1.3.28

References and patches

https://snapcreek.com/duplicator/docs/changelog/?lite Release NotesVendor Advisory
https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affe… ExploitThird Party Advisory
https://cwe.mitre.org/data/definitions/23.html Not Applicable
http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11738 US Government Resource

CPE matches (NVD) (2)

cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:* < 1.3.28
cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:pro:wordpress:*:* < 3.8.7.1

CVSS score

7.5High

Source: mitre · CVSS 3.0

Attack complexity: Low
Attack vector: Network
Availability: None
Confidentiality: High
Integrity: None
Privileges required: None
Scope: Unchanged
User interaction: None

CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N

All scores (4)

cna	CVSS 3.0	7.5High
nvd	CVSS 3.1	7.5High
cve@mitre.org	CVSS 3.0	7.5High
nvd	CVSS 2.0	5.0Medium

EPSS (chance of exploitation in 30 days)

97.82%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: partial

Timeline

ID reserved2020-04-13
Published2020-04-14 00:20
Reached IP-DB2026-10-24 23:35
Added to KEV2021-11-03
Last updated2026-06-17 05:50

Assigned by (CNA): mitre
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

5.3Medium

CVE-2026-91075 1 hour ago

Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass

Eupago Gateway For Woocommerce

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark…

5.3Medium

CVE-2026-103327 1 hour ago

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret

CryptoCloud

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthe…

Unscored

CVE-2026-103379 3 hours ago

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

WATI Chat and Notification

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order…

Unscored

CVE-2026-104647 3 hours ago

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

weMail

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as autho…

Unscored

CVE-2026-104648 3 hours ago

weMail <= 2.1.6 - Editor+ API Key Disclosure

weMail

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credentia…

Unscored

CVE-2026-105967 3 hours ago

Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter

Gallery for Social Photo

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read th…