The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the…

published 2020-04-13 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4080

cvss: 7.5; version 3.0, CNA
cisa kev: Exploited; added 2021-11-03
epss: 97.8%; EPSS 97.8% chance of exploitation in 30 days, percentile 99.9%
public exploits: 2; Metasploit, Exploit-DB, plus a Nuclei check

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

awesomemotive duplicator 1.3.28, 3.8.7.1

Timeline

2020-02-19 First public exploit (Metasploit auxiliary/scanner/http/wp_duplicator_file_read)
2020-04-13 Published
2021-11-03 Added to CISA KEV
2022-05-03 CISA patch deadline
2025-02-04 CISA SSVC: exploitation active

Known exploited

Added: 5 y ago (2021-11-03)
Patch by: 2022-05-03 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: WordPress, Snap Creek Duplicator Plugin
CISA name: WordPress Snap Creek Duplicator Plugin File Download Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: partial
Assessed: 21 mo ago (2025-02-04)

Exploit prediction

97.82% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/scanner/http/wp_duplicator_file_read WordPress Duplicator File Read Vulnerability metasploit auxiliary, normal rank, 2020-02-19
EDB-50420 Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read webapps, 2021-10-18
Nuclei template WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion nuclei detection template
wordfence.com https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/ referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.5	CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

Technology feeds

WordPress rss critical rss

References

wordfence.com /blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/
exploit, third-party-advisory
packetstormsecurity.com /files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html
exploit, third-party-advisory, vdb-entry
packetstormsecurity.com /files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html
exploit, third-party-advisory, vdb-entry
snapcreek.com /duplicator/docs/changelog/?lite
release-notes, vendor-advisory
cwe.mitre.org /data/definitions/23.html
not-applicable
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11738
government-resource, us-government-resource

Sources

CVE List CVE-2020-11738
NVD CVE-2020-11738

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary