File Download Vulnerability in WordPress Snap Creek Duplicator Plugin (CVE‑2020‑11738) Allows Unauthorized Access to Site Backups
What It Is – The Snap Creek Duplicator (and Duplicator Pro) WordPress plugin contains an insecure file‑download flaw. When an administrator creates a site copy, the plugin stores the backup files in a location that can be accessed via a crafted request, enabling an unauthenticated attacker to retrieve those archives.
Exploitability – The vulnerability is publicly disclosed (CVE‑2020‑11738) and can be exploited without authentication. Public proof‑of‑concept code exists; the CVSS base score is 7.5 (High).
Affected Products – WordPress Snap Creek Duplicator (free) and Duplicator Pro plugin, versions prior to the vendor‑released patch (2020‑12‑15).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous third‑party component monitoring; unmanaged plugins become a blind spot in the control environment.
- Provides evidence that access‑control policies must extend to all software supply‑chain elements, not just core platforms.
- Highlights the importance of maintaining a defensible audit trail of plugin versions and configuration changes to satisfy auditors and enterprise buyers.
Recommended Actions
- Apply the vendor’s security patch immediately or remove the plugin if not required.
- Conduct an inventory of all WordPress plugins and map each to a risk rating.
- Enable logging of file‑download requests and integrate the logs into a centralized SIEM for continuous monitoring.
- Review admin role permissions; enforce least‑privilege for users who can trigger site copies.
Source: CISA KEV – CVE‑2020‑11738