CVE-2020-11738

What it actually does

The flaw permits directory traversal by supplying ../ sequences in the file parameter to duplicator_download or duplicator_init endpoints, allowing read access to files outside the web root.

Why it matters to the business

Attackers can steal configuration files, credentials, and other sensitive data from affected sites; the issue carries high exploit probability, is listed in CISA KEV with a 2022-05-03 remediation deadline, and remains actively exploited years after disclosure.

How an attack unfolds

Threat actors targeting the WordPress Snap Creek Duplicator Plugin File Download Vulnerability send unauthenticated HTTP requests containing directory traversal payloads in the file parameter to the duplicator_download or duplicator_init endpoints, retrieving arbitrary server files such as configuration or database credentials.

How to fix it

Upgrade the Snap Creek Duplicator plugin to 1.3.28 or newer and Duplicator Pro to 3.8.7.1 or newer; for gitlab-org/gitlab apply the fix in commit e5a4c9dc9077d8e96e74118cd00dfa452bd4522b and verify no custom duplicator endpoints remain exposed.

How to confirm the fix worked

After patching, confirm that requests containing ../ in the file parameter return errors or sanitized responses rather than file contents; scan plugin directories for versions below the fixed releases.

Typical attack path

1. Locate a WordPress site running the vulnerable Duplicator plugin
2. Send crafted GET/POST requests to duplicator_download or duplicator_init with file=../../../wp-config.php or similar traversal strings
3. Receive file contents in the response
4. Exfiltrate sensitive data for further compromise or ransomware staging

How to detect it

Search web server access logs for requests to duplicator_download or duplicator_init containing repeated ../ sequences or attempts to retrieve known sensitive files such as wp-config.php; correlate with threat actor activity around the WordPress Snap Creek Duplicator Plugin File Download Vulnerability.

• duplicator_download?file=../
• duplicator_init?file=../
• ../wp-config.php
• ../wp-content/
• file=..%2f..%2f

What your security team should do

• Immediately apply the vendor-supplied updates given the KEV listing and high EPSS score
• Audit all WordPress instances for the Duplicator plugin and remove or isolate any unpatched deployments
• Add WAF rules blocking traversal sequences in file parameters to duplicator endpoints
• Review logs for historical traversal attempts to assess prior exposure