CVE-2020-11738: Duplicator Path Traversal Vulnerability

CVE-2020-11738 Overview

CVE-2020-11738 is a Directory Traversal vulnerability affecting the Snap Creek Duplicator plugin for WordPress. The vulnerability exists in versions prior to 1.3.28 (Lite) and 3.8.7.1 (Pro), allowing unauthenticated attackers to read arbitrary files from the web server by manipulating the file parameter in the duplicator_download or duplicator_init endpoints using path traversal sequences such as ../.

This vulnerability is particularly dangerous because the Duplicator plugin is widely used for WordPress site migration and backup purposes, with over one million active installations. Successful exploitation allows attackers to download sensitive configuration files including wp-config.php, which contains database credentials and authentication keys.

Critical Impact

This vulnerability has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can leverage this flaw to extract sensitive configuration files, database credentials, and potentially gain full control of WordPress installations.

Affected Products

• Awesomemotive Duplicator (Lite) versions before 1.3.28
• Awesomemotive Duplicator Pro versions before 3.8.7.1
• WordPress installations running vulnerable Duplicator plugin versions

Discovery Timeline

• 2020-04-13 - CVE-2020-11738 published to NVD
• 2026-02-02 - Last updated in NVD database

Technical Details for CVE-2020-11738

Vulnerability Analysis

The Snap Creek Duplicator plugin implements file download functionality through the duplicator_download and duplicator_init AJAX actions. The vulnerability stems from insufficient input validation on the file parameter passed to these endpoints. When processing file download requests, the plugin fails to properly sanitize path traversal sequences, allowing attackers to escape the intended directory and access files anywhere on the file system that the web server process has read permissions for.

The attack requires no authentication, making it trivially exploitable by any remote attacker who can reach the WordPress installation. The most common exploitation target is the wp-config.php file, which contains database connection strings, authentication salts, and other sensitive configuration data. With access to these credentials, attackers can directly connect to the database, extract user data, or escalate their access to achieve full site compromise.

According to Wordfence's analysis, active attacks exploiting this vulnerability began shortly after the patch was released, targeting sites that had not yet updated.

Root Cause

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The vulnerable code accepts user-supplied input for the file parameter and uses it directly in file system operations without properly validating or sanitizing the path. Specifically, the code fails to:

1. Canonicalize the path to resolve relative path components
2. Verify the resolved path remains within the intended directory
3. Reject path traversal sequences such as ../ or encoded variants

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker crafts a malicious HTTP request to the WordPress AJAX handler, specifying a file parameter containing directory traversal sequences. The vulnerable endpoint processes this request and returns the contents of the targeted file.

A typical exploitation scenario targets the wp-config.php file located in the WordPress root directory. By sending a request with path traversal sequences pointing to this file relative to the plugin's expected directory, the attacker receives the complete configuration file contents, including:

• Database hostname, username, and password
• WordPress authentication keys and salts
• Table prefix and other configuration options
• Potentially hardcoded API keys or custom credentials

For detailed technical exploitation information, refer to the Packet Storm Security advisory.

Detection Methods for CVE-2020-11738

Indicators of Compromise

• HTTP requests to /wp-admin/admin-ajax.php containing action=duplicator_download or action=duplicator_init with suspicious file parameters
• Web server access logs showing requests with ../ sequences targeting WordPress AJAX endpoints
• Unexpected access to wp-config.php or other sensitive configuration files
• Authentication failures or suspicious database access from unfamiliar IP addresses following potential credential theft

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Configure intrusion detection systems (IDS) to alert on requests containing ../ sequences to WordPress admin AJAX endpoints
• Monitor web server access logs for requests to admin-ajax.php with duplicator_download or duplicator_init actions containing path traversal indicators
• Deploy file integrity monitoring on sensitive configuration files to detect unauthorized access attempts

Monitoring Recommendations

• Enable verbose logging for WordPress AJAX requests and review regularly for anomalies
• Set up real-time alerting for any access attempts to wp-config.php through web requests
• Monitor database authentication logs for connections from unexpected sources that may indicate credential theft
• Review Duplicator plugin activity logs for unusual file download operations

How to Mitigate CVE-2020-11738

Immediate Actions Required

• Update Duplicator (Lite) to version 1.3.28 or later immediately
• Update Duplicator Pro to version 3.8.7.1 or later immediately
• Rotate WordPress database credentials and authentication keys/salts if exploitation is suspected
• Review web server access logs for evidence of exploitation attempts
• Consider temporarily disabling the Duplicator plugin if immediate patching is not possible

Patch Information

The vendor has released patched versions that properly validate file paths before processing download requests. The fix ensures that the file parameter cannot escape the intended directory through path traversal sequences.

• Duplicator Lite: Update to version 1.3.28 or later via the WordPress plugin repository
• Duplicator Pro: Update to version 3.8.7.1 or later through the SnapCreek customer portal

For complete changelog information, refer to the SnapCreek Duplicator Changelog.

Workarounds

• Implement WAF rules to block requests containing path traversal sequences (../, ..%2f, %2e%2e/) in the file parameter
• Restrict access to admin-ajax.php from untrusted IP addresses if feasible
• Temporarily remove or deactivate the Duplicator plugin until patching can be completed
• Apply filesystem permissions to restrict web server read access to sensitive files where possible

# Example: Add Apache mod_rewrite rules to block path traversal attempts
# Add to .htaccess in WordPress root directory
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
RewriteCond %{QUERY_STRING} (\.\.%2f) [NC,OR]
RewriteCond %{QUERY_STRING} (%2e%2e/) [NC]
RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]