PT-2020-6521 · WordPress · Duplicator Pro+1

Published 2020-02-19 · Updated 2026-02-02 · CVE-2020-11738

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Duplicator plugin versions prior to 1.3.28 Duplicator Pro versions prior to 3.8.7.1

Description The issue allows Directory Traversal via ../ in the file parameter to duplicator download or duplicator init API endpoints, such as "/wp-admin/admin-ajax.php?action=duplicator download&file=../../../../../../../../../etc/passwd". This can enable a remote attacker to disclose protected information.

Recommendations For Duplicator plugin versions prior to 1.3.28, update to version 1.3.28 or later. For Duplicator Pro versions prior to 3.8.7.1, update to version 3.8.7.1 or later. As a temporary workaround, consider restricting access to the duplicator download and duplicator init API endpoints until a patch is available. Avoid using the file parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-05939

CVE-2020-11738

Affected Products

Duplicator

Duplicator Pro

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_duplicator_file_read.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html · Exploit
• 🔥 https://wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites · Exploit
• 🔥 https://exploit-db.com/exploits/50420 · Exploit
• 🔥 http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11738 · Security Note
• https://bdu.fstec.ru/vul/2021-05939 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11738 · Vendor Advisory
• https://snapcreek.com/duplicator/docs/changelog/?lite · Vendor Advisory
• https://t.me/cvenotify/2701 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://cwe.mitre.org/data/definitions/23.html · Note
• https://t.me/cvenotify/7406 · Telegram Post
• https://twitter.com/ksg93rd/status/1852013840294134045 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11738 · Note