CVE-2020-11738

What is the Duplicator Plugin?

Duplicator is a widely used WordPress plugin (from Snap Creek) for cloning, backing up, and migrating WordPress sites — it packages the entire site (files and database) into an archive that an administrator can move to a new host. To perform that migration, Duplicator generates an installer.php script alongside the backup archive that walks through re-installing the site on the destination server.

Overview

CVE-2020-11738 is a path traversal / file download vulnerability (CWE-22) in Duplicator and Duplicator Pro. When an administrator creates a site backup, the generated installer and archive files can remain accessible on the site's web-accessible directory afterward. An unauthenticated remote attacker who locates these leftover files can download them directly (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High).

Technical Details

The generated backup archive is a complete snapshot of the WordPress installation, including wp-config.php — the file containing the site's database credentials, authentication secret keys, and other sensitive configuration. If the installer and archive files aren't deleted or protected after use, they remain sitting in a predictable, web-accessible location, letting anyone who requests the right filename download the entire site, credentials included.

Discovery

Publicly tracked via NVD; consistent with a broader, recurring category of WordPress plugin vulnerabilities where backup/migration tools generate sensitive artifacts that administrators forget to remove after use.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Because the vulnerability requires no authentication and directly exposes database credentials, it's an efficient reconnaissance and initial-access step for an attacker — full database credentials from wp-config.php can lead directly to further compromise of the site and potentially the hosting environment if credentials are reused.

Remediation

1. Update Duplicator/Duplicator Pro to the patched version that addresses this vulnerability.
2. Delete the installer.php file and any leftover backup archives from your site's web-accessible directory immediately after completing any migration — the plugin's own documentation recommends this, and this vulnerability is exactly why.
3. Rotate database credentials and WordPress secret keys (wp-config.php values) if you suspect a backup archive was ever exposed on a live site.
4. Scan your site for unexpected .zip or installer.php files left over from past migrations, particularly on sites that have changed hosts or been cloned in the past.