CVE-2020-11738

KEVHIGH 7.5EPSS 97.8%

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 97.82% chance of exploitation in the next 30 days, 100th percentile
CISA KEV: added 2021-11-03
Nuclei: high · CWE-22
Published: 2020-04-13
Updated: 2026-01-12

Proof-of-concept exploits (2)

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11738.yaml

Metasploit modules (1)

rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_duplicator_file…

ExploitDB entries (1)

https://www.exploit-db.com/exploits/50420

Exploit collections (1)

zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-11738.yaml