---
id: "CVE-2020-11738"
kind: "vulnerability"
aliases: ["CVE-2020-11738"]
title: "WordPress Snap Creek Duplicator Plugin: WordPress Snap Creek Duplicator Plugin File Download Vulnerability"
severity: "high"
cvss: 7.5
epss: 0.97822
exploited: true
status: "open"
category: "package"
products: [{"name": "WordPress Snap Creek Duplicator Plugin", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["duplicator", "exploited", "package", "self-hosted", "wordpress"]
not_affected_if: ["managed-hosting", "plugin-not-installed"]
published_at: "2020-04-13T22:15:10+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:41+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11738", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-11738", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11738", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# WordPress Snap Creek Duplicator Plugin: WordPress Snap Creek Duplicator Plugin File Download Vulnerability

The Duplicator WordPress plugin (Free and Pro) has a file download flaw that lets an attacker download the site copy files generated when an administrator creates a backup or migration package. Those files can contain database contents and configuration secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WordPress Snap Creek Duplicator Plugin affected ? fixed ?

## How to check

Check the installed Duplicator version under the WordPress Plugins page or in wp-content/plugins/duplicator/ and compare it with the fixed version.

## Fix

Update Duplicator and Duplicator Pro to the vendor-fixed version, as CISA requires; the exact fixed version is unknown from the sources.
Delete any leftover package files in the Duplicator storage area once updated, and rotate database and API credentials if old packages were exposed.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11738
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-11738
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-11738

## From the sources

WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_