CVE-2020-11738: WordPress Snap Creek Duplicator Plugin File Download Vulnerability
First published: Mon Apr 13 2020(Updated: )
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Snapcreek Duplicator | <1.3.28 | |
| Snapcreek Duplicator | <3.8.7.1 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html
- http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html
- https://cwe.mitre.org/data/definitions/23.html
- https://snapcreek.com/duplicator/docs/changelog/?lite
- https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/
- https://nvd.nist.gov/vuln/detail/CVE-2020-11738
Frequently Asked Questions
What is CVE-2020-11738?
CVE-2020-11738 is a vulnerability in the WordPress Snap Creek Duplicator Plugin.
What is the severity of CVE-2020-11738?
CVE-2020-11738 has a severity level of high, with a severity value of 7.5.
How does CVE-2020-11738 affect the Snap Creek Duplicator Plugin?
CVE-2020-11738 allows an attacker to download generated files from the WordPress Snap Creek Duplicator Plugin dashboard.
Which versions of the Snap Creek Duplicator Plugin are affected by CVE-2020-11738?
Versions up to and exclusive of Duplicator 1.3.28 and Dulplicator Pro 3.8.7.1 are affected by CVE-2020-11738.
How can I mitigate the vulnerability in the Snap Creek Duplicator Plugin?
To mitigate CVE-2020-11738, update the Snap Creek Duplicator Plugin to version 1.3.29 or Pro version 3.8.7.2 or later.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/severity
- agent/title
- agent/weakness
- agent/author
- agent/description
- agent/event
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/snapcreek
- canonical/snapcreek duplicator
- vendor/wordpress
- canonical/wordpress snap creek duplicator plugin