WordPress Duplicator Plugin Directory Traversal & Arbitrary File Download (CVE-2020-11738)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-11738) is a critical directory traversal and arbitrary file read vulnerability found in the Snap Creek Duplicator and Duplicator Pro plugins for WordPress. The root cause lies in the lack of input validation and sanitization of the file parameter within the duplicator_download or duplicator_init action handlers. Because the plugin fails to filter directory traversal sequences (such as ../), unauthenticated users can escape the intended directory structure and access arbitrary files on the server.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can initiate the exploit by sending a crafted HTTP GET or POST request to the WordPress AJAX endpoint (admin-ajax.php). The attack scenario proceeds as follows:

• The attacker sends a request targeting admin-ajax.php with the parameter action=duplicator_download and sets the file parameter to a relative path pointing to a sensitive file, such as ../../../../wp-config.php.
• The vulnerable Duplicator plugin processes the request without validating whether the resolved path lies within the allowed directory boundaries.
• The application reads the requested file and returns it in the HTTP response, allowing the attacker to extract database credentials (DB_USER, DB_PASSWORD) and authentication salts from wp-config.php.

3. Infrastructure & Business Impact

This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and carries an extremely high EPSS score of 0.9782, indicating widespread active exploitation in the wild. Exposure of the wp-config.php file allows attackers to gain direct access to the underlying database, leading to full administrative takeover of the WordPress site, data exfiltration, site defacement, or deployment of malicious web shells.