WordPress Snap Creek Duplicator Plugin File Download Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| duplicator | < 1.3.28< 3.8.7.1 | 1.3.283.8.7.1 |
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free