Wordpress Snap Creek Duplicator - Path Traversal (CVE-2020-11738)
Description
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
psychologyCrowdSec Analysis
CVE-2020-11738 is a vulnerability affecting the Snap Creek Duplicator plugin for WordPress. It enables attackers to perform directory traversal by manipulating crafted parameters, which can lead to unauthorized file access on the underlying server.
CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.
CrowdSec network data shows that most actors exploiting CVE-2020-11738 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2020-11738 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Observed attacks commonly attempt to access the /wp-admin/admin-ajax.php endpoint using parameters indicative of file download and traversal activity.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-04-13 |
| CISA KEV | 2021-11-03 |
| CISA Remediation Deadline | 2022-05-03 |
| Rule Released | 2023-12-15 |
| CrowdSec First Seen | 2023-12-15 |