EIP-2026-113696

This Metasploit module exploits an unauthenticated directory traversal vulnerability in the WordPress Duplicator plugin (versions 1.3.24-1.3.26), allowing arbitrary file read with web server privileges. It sends a crafted GET request to 'admin-ajax.php' with a traversal payload to read sensitive files like '/etc/passwd'.