PT-2022-9631 · WordPress · Duplicate Page/Post

Krzysztof Zając · Published 2022-02-21 · Updated 2022-02-28 · CVE-2021-25075

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Duplicate Page or Post WordPress plugin versions prior to 1.5.1

Description The issue concerns a lack of authorization and a flawed CSRF check in the wpdevart duplicate post parametrs save in db AJAX action. This allows any authenticated user to change the plugin's settings or perform a CSRF attack. Additionally, the lack of escaping could lead to Stored Cross-Site Scripting issues.

Recommendations For versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the wpdevart duplicate post parametrs save in db AJAX action to prevent unauthorized changes to the plugin's settings.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-25075

Affected Products

Duplicate Page/Post

References · 3

• 🔥 https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25075 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25075 · Vendor Advisory