{"id":"CVE-2020-11738","kind":"vulnerability","aliases":["CVE-2020-11738"],"related":[],"title":"WordPress Snap Creek Duplicator Plugin: WordPress Snap Creek Duplicator Plugin File Download Vulnerability","description":"WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.\n\nCISA required action: Apply updates per vendor instructions.","summary":"The Duplicator WordPress plugin (Free and Pro) has a file download flaw that lets an attacker download the site copy files generated when an administrator creates a backup or migration package. Those files can contain database contents and configuration secrets.","severity":"high","cvss":7.5,"epss":0.97822,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"WordPress Snap Creek Duplicator Plugin","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["duplicator","exploited","package","self-hosted","wordpress"],"not_affected_if":["managed-hosting","plugin-not-installed"],"how_to_check":"Check the installed Duplicator version under the WordPress Plugins page or in wp-content/plugins/duplicator/ and compare it with the fixed version.","fix":"Update Duplicator and Duplicator Pro to the vendor-fixed version, as CISA requires; the exact fixed version is unknown from the sources.\nDelete any leftover package files in the Duplicator storage area once updated, and rotate database and API credentials if old packages were exposed.","status":"open","published_at":"2020-04-13T22:15:10+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:41+00:00","updated_at":"2026-10-23T20:29:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:29:41Z","model":"claude-haiku-5-5","output":{"fix":"Update Duplicator and Duplicator Pro to the vendor-fixed version, as CISA requires; the exact fixed version is unknown from the sources.\nDelete any leftover package files in the Duplicator storage area once updated, and rotate database and API credentials if old packages were exposed.","summary":"The Duplicator WordPress plugin (Free and Pro) has a file download flaw that lets an attacker download the site copy files generated when an administrator creates a backup or migration package. Those files can contain database contents and configuration secrets.","category":"package","who_cares":["wordpress","duplicator","self-hosted"],"confidence":0.7,"analyst_note":"Confirm the affected and fixed Duplicator version range from the NVD or vendor advisory and the exact check path for the plugin version.","how_to_check":"Check the installed Duplicator version under the WordPress Plugins page or in wp-content/plugins/duplicator/ and compare it with the fixed version.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","plugin-not-installed"],"severity_if_unknown":"high"},"cost_usd":0.000408,"input_tokens":2164,"output_tokens":383,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-11738':16A,19A '-2020':15A,18A 'action':114C 'administr':56B,84C 'affect':107C 'allow':93C 'appli':115C 'attack':47B,95C 'backup':59B 'cisa':112C 'configur':70B 'contain':66B,77C 'content':68B 'copi':51B,88C 'creat':57B,85C 'creek':3A,8A,22A,74C 'cve':14A,17A 'dashboard':104C 'databas':67B 'download':12A,42B,48B,80C,97C 'dulplic':110C 'duplic':4A,9A,25B,33B,75C,108C 'duplicator':23A 'exploit':26B 'file':11A,41B,52B,64B,79C,100C 'flaw':43B 'free':36B 'generat':53B,99C 'host':30B 'instruct':119C 'let':45B 'migrat':61B 'new':87C 'packag':27B,62B 'per':117C 'plugin':5A,10A,24A,35B,76C 'pro':38B,111C 'requir':113C 'secret':71B 'self':29B 'self-host':28B 'site':50B,91C 'snap':2A,7A,21A,73C 'updat':116C 'vendor':118C 'vulner':13A,81C,106C 'wordpress':1A,6A,20A,31B,34B,72C,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-04-13T22:15:10+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-11738","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11738","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T17:39:59+00:00","note":null},{"source":"epss","external_id":"CVE-2020-11738","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11738","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-11738","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11738","severity":null,"published_at":"2020-04-13T22:15:10+00:00","modified_at":"2026-06-17T02:50:42+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}