High
CVSS 7.5
Overview
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
CVE-2020-11738
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro...
Risk analysis
This vulnerability is rated 🟠 HIGH.
- CVSS: 7.5 (HIGH)
- Detected tags: path, wordpress (tag impact: MODERATE)
Recommended actions:
- Canonicalize path; block `..` traversal; use allowlists.