PT-2021-23835 · WordPress · Duplicate Post

Published 2021-11-19 · Updated 2021-11-24 · CVE-2021-43408

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin version 1.1.9 and earlier

Description The issue occurs due to SQL injection vulnerabilities, which happen when client-supplied data is included within an SQL query insecurely. This can be exploited to read, modify, and delete SQL table data. In many cases, it is also possible to exploit features of the SQL server to execute system commands and/or access the local file system. The vulnerability can be exploited by any authenticated user who has been granted access to use the Duplicate Post plugin, which by default is limited to Administrators, but can also be permitted for Editor, Author, Contributor, and Subscriber roles.

Recommendations For Duplicate Post WordPress plugin version 1.1.9 and earlier, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the plugin to minimize the risk of exploitation, especially for roles that have been granted permission to use it. As a temporary workaround, limit the access to the plugin to only necessary users. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-43408

Affected Products

Duplicate Post

References · 6

• 🔥 https://appcheck-ng.com/security-advisory-duplicate-post-wordpress-plugin-sql-injection-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2021-43408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43408 · Security Note
• https://t.me/cvenotify/23620 · Telegram Post
• https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.2.0/post/handler.php#L510 · Note
• https://t.me/cibsecurity/32703 · Telegram Post