CVE-2020-11738: 
WordPress vulnerability analysis and mitigation

The Snap Creek Duplicator plugin before version 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) contains a directory traversal vulnerability (CVE-2020-11738) that was discovered in February 2020. The vulnerability affects over 1 million WordPress installations and allows unauthenticated attackers to download arbitrary files from affected systems using '../' sequences in the file parameter to duplicatordownload or duplicatorinit functions (Wordfence, WPScan).

The vulnerability has a CVSS v3.1 base score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue allows attackers to use directory traversal sequences like '../' in HTTP GET requests to access files outside the intended directory. The vulnerability can be exploited via the 'file' parameter in requests to duplicatordownload or duplicatorinit endpoints. A proof of concept exploit involves sending a request like 'http://example.com/wp-admin/admin-ajax.php?action=duplicator_download&file=../wp-config.php' (AttackerKB, NVD).

The vulnerability allows attackers to read arbitrary files on the affected system, including sensitive configuration files like wp-config.php which may contain database credentials and other critical information. This access could lead to further system compromise depending on the server configuration and file permissions. The vulnerability affects both the free version (Duplicator) and pro version (Duplicator Pro) of the plugin (Wordfence).

Users should immediately update to Duplicator version 1.3.28 or Duplicator Pro version 3.8.7.1 or later to patch this vulnerability. The vulnerability was only present in versions 1.3.24 and 1.3.26 of the free version, and versions before 3.8.7.1 of the pro version (WPScan, Snapcreek Changelog).

The security community has noted this as a critical vulnerability due to its widespread impact and active exploitation. Wordfence reported that approximately 150,000 out of 170,000 active installations were vulnerable at the time of discovery (Wordfence).