High · published April 13, 2020
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A sneaky directory traversal flaw in the Snap Creek Duplicator plugin can let attackers access files they shouldn’t! 🔥 Think of it like a delivery person who follows a poorly written address and accidentally opens the wrong door to grab packages that aren’t theirs — that's how this vulnerability allows access to sensitive files! An attacker could exploit this vulnerability to read any file on the server, putting sensitive information at risk, like user data or configuration files. This is absolutely devastating for any WordPress site relying on this plugin, as it can lead to further attacks or data loss that could easily compromise your whole setup!
Think of it like a delivery person who follows a poorly written address and accidentally opens the wrong door to grab packages that aren’t theirs — that's how this vulnerability allows access to sensitive files! This directory traversal vulnerability arises from insufficient validation of the file parameter in the duplicator_download and duplicator_init functions, allowing attackers to manipulate the path and access unauthorized files on the server.
An attacker could exploit this vulnerability to read any file on the server, putting sensitive information at risk, like user data or configuration files. This is absolutely devastating for any WordPress site relying on this plugin, as it can lead to further attacks or data loss that could easily compromise your whole setup! To protect yourself, immediately update the Duplicator plugin to version 1.3.28 or later and Duplicator Pro to 3.8.7.1 or later. Additionally, audit your server for any accessed files to ensure no sensitive data has been compromised. Don't push this off — the sooner the better! You’ve got this! Follow these steps, and you’ll have your site secured in no time! 🛡️