PT-2025-1861 · WordPress · Post Duplicator

Craig Smith + 1 · Published 2025-01-11 · Updated 2025-01-11 · CVE-2024-12472

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Post Duplicator plugin for WordPress version 2.36 and earlier

Description The issue is related to Information Exposure due to insufficient restrictions on which posts can be duplicated, making it possible for authenticated attackers with Contributor-level access and above to extract data from password protected, private, or draft posts by duplicating the post. This is achieved via the mtphr duplicate post() function.

Recommendations For Post Duplicator plugin for WordPress version 2.36 and earlier, update to a version later than 2.36 to resolve the issue. As a temporary workaround, consider restricting access to the mtphr duplicate post() function to minimize the risk of exploitation. Additionally, restrict the ability to duplicate posts to only trusted users to prevent unauthorized data exposure.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-12472

Affected Products

Post Duplicator

References · 8

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219375%40post-duplicator&new=3219375%40post-duplicator&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2024-12472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12472 · Security Note
• https://t.me/cvedetector/15026 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3071b2dc-9673-4e30-bd04-7404eb6a1ed9?source=cve · Note
• https://twitter.com/CVEnew/status/1877921987667861750 · Twitter Post
• https://t.me/cvenotify/107131 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1878024967020773822 · Twitter Post