Wordpress Snap Creek Duplicator - Path Traversal (CVE-2020-11738)

CVE-2020-11738 is a vulnerability affecting the Snap Creek Duplicator plugin for WordPress. It enables attackers to perform directory traversal by manipulating crafted parameters, which can lead to unauthorized file access on the underlying server.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

CrowdSec network data shows that most actors exploiting CVE-2020-11738 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2020-11738. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed attacks commonly attempt to access the /wp-admin/admin-ajax.php endpoint using parameters indicative of file download and traversal activity.