CVE-2020-11738

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

• CWE-22
• CWE-22

• http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
• https://cwe.mitre.org/data/definitions/23.htmlNot Applicable
• https://snapcreek.com/duplicator/docs/changelog/?liteRelease Notes, Vendor Advisory
• https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
• https://cwe.mitre.org/data/definitions/23.htmlNot Applicable
• https://snapcreek.com/duplicator/docs/changelog/?liteRelease Notes, Vendor Advisory
• https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11738US Government Resource

Published

Apr 13, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11732The Media Library Assistant plugin before 2.82 for Wordpress…7.5
• CVE-2020-11733An issue was discovered on Spirent TestCenter and Avalanche …6.7
• CVE-2020-11734cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS…6.1
• CVE-2020-11735The private-key operations in ecc.c in wolfSSL before 4.4.0 …5.3
• CVE-2020-11736fr-archive-libarchive.c in GNOME file-roller through 3.36.1 …3.9
• CVE-2020-11737A cross-site scripting (XSS) vulnerability in Web Client in …6.1
• CVE-2020-11739An issue was discovered in Xen through 4.13.x, allowing gues…7.8
• CVE-2020-1174A remote code execution vulnerability exists when the Window…7.8
• CVE-2020-11740An issue was discovered in xenoprof in Xen through 4.13.x, a…5.5
• CVE-2020-11741An issue was discovered in xenoprof in Xen through 4.13.x, a…8.8
• CVE-2020-11742An issue was discovered in Xen through 4.13.x, allowing gues…5.5
• CVE-2020-11743An issue was discovered in Xen through 4.13.x, allowing gues…5.5