CVE-2020-11738: WordPress Snap Creek Duplicator Plugin File Download Vulnerability

CVE-2020-11738 is a file download vulnerability in the WordPress Snap Creek Duplicator plugin (including Duplicator Pro). When an administrator creates a new copy of their site, the plugin can leave generated backup or package files reachable in a way that lets an attacker download them. Those packages often contain full site content, configuration, and credentials, so unauthorized access can expose sensitive data and open a path to further compromise. Defenders should treat this as a high-priority inventory and patch issue on any WordPress estate that uses the plugin.

How it works

The weakness is classified as CWE-22 (improper limitation of a pathname to a restricted directory). In practical terms, the plugin’s packaging workflow produces archive or installer files that are intended for the site administrator. Because of insufficient controls on how those files are named, stored, or requested, an unauthenticated or low-privilege attacker can request and retrieve the generated files. The CISA summary states that the vulnerability appears when an administrator creates a new copy of the site and that an attacker can then download the generated files from the WordPress environment. Exact request paths, parameters, and conditions must be confirmed against the vendor advisory; do not rely on third-party write-ups alone. Successful abuse yields the backup package itself, which commonly includes database dumps, wp-config.php contents, and other secrets.

Am I affected? How to find it in your systems

The affected software is the Snap Creek Duplicator plugin for WordPress, both the free Duplicator edition and Duplicator Pro. It is typically installed on WordPress sites used for migration, backup, or cloning workflows and appears under the plugins directory or in the WordPress admin plugins list.

• Inventory every WordPress instance (production, staging, and development). Check the installed plugins list for “Duplicator” or “Duplicator Pro” and record the installed version.
• Search the filesystem for the plugin slug (commonly under wp-content/plugins/) and for leftover installer or archive files that Duplicator may have written (for example packages left in publicly reachable directories after a migration).
• Review web-server and application logs for unusual requests that retrieve large archive files, installer PHP files, or paths associated with Duplicator package names. Look for spikes in downloads of .zip, .daf, or similarly named packages around the time administrators ran packaging jobs.
• Confirm exact affected version ranges and fixed releases only from the vendor advisory; public secondary sources may be incomplete.

How to remediate

Patch first. Apply the updates published by the vendor for Duplicator and Duplicator Pro exactly as described in the official advisory and in the CISA required action (“Apply updates per vendor instructions”). After updating:

• Remove any leftover installer, archive, or package files that were generated before the patch; these files remain valuable to an attacker even after the code is fixed.
• Rotate credentials that may have been present inside packages (database passwords, WordPress salts, API keys, and any other secrets commonly stored in wp-config.php or the database dump).
• Restrict write and read permissions on directories used for temporary packages so that only the necessary WordPress processes can access them, and ensure those directories are not directly web-accessible once packaging is complete.
• Re-scan the site with your usual WordPress integrity and malware tools to confirm no unauthorized packages or backdoors remain.

If you can't patch immediately

If an immediate update is not possible, reduce exposure with compensating controls while you schedule the patch:

• Temporarily deactivate or remove the Duplicator plugin on internet-facing sites until the fixed version can be installed.
• Block or tightly restrict web access to directories and file patterns used by Duplicator packages (virtual patching via WAF or web-server rules). Confirm rule efficacy against the vendor’s description of the flaw.
• Segment WordPress hosts so that only required administrative networks can reach the admin dashboard and any package-download endpoints.
• Increase monitoring for large file downloads and for creation of new package files; alert on anomalous access to those paths.
• Ensure that any packaging jobs are performed only on non-production or network-isolated copies when feasible, and delete packages immediately after legitimate use.

If your data may have been exposed

Actively exploited file-download flaws in backup and migration plugins frequently lead to full site compromise and credential theft. If packages may have been retrieved, assume database contents and configuration secrets are at risk: rotate all related credentials, review account and file integrity, and follow your incident-response process. You can also run a free exposure scan of your email addresses against known breach data to see whether associated credentials have appeared in public breach corpora.