PT-2025-1889 · WordPress · Duplicate Post

Craig Smith + 1 · Published 2025-01-07 · Updated 2025-01-07 · CVE-2024-12538

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Duplicate Post, Page and Any Custom Post plugin for WordPress versions up to and including 3.5.3

Description The issue allows authenticated attackers with Contributor-level access and above to extract potentially sensitive data from draft, scheduled, private, and password-protected posts through the dpp duplicate as draft function.

Recommendations For versions up to and including 3.5.3, update to a version higher than 3.5.3 to resolve the issue. As a temporary workaround, consider restricting access to the dpp duplicate as draft function until a patch is available. Restrict user access to the plugin's functionality to minimize the risk of exploitation, especially for users with Contributor-level access and above.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-12538

Affected Products

Duplicate Post

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-12538 · Security Note
• https://plugins.trac.wordpress.org/browser/duplicate-pp/trunk/duplicate-pp.php#L22 · Note
• https://twitter.com/CVEnew/status/1876476549827842430 · Twitter Post
• https://t.me/cvedetector/14436 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f38543ff-1074-4273-be33-8142d59e904f?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3220879 · Note