CVE-2024-12472
📋 TL;DR
The Post Duplicator WordPress plugin allows authenticated attackers with Contributor-level access or higher to duplicate password-protected, private, or draft posts they shouldn't have access to, exposing sensitive content. This affects all WordPress sites using Post Duplicator version 2.36 or earlier.
💻 Affected Systems
- Post Duplicator WordPress Plugin
📦 What is this software?
Post Duplicator by Metaphorcreations
⚠️ Risk & Real-World Impact
Worst Case
Sensitive unpublished content, confidential drafts, or password-protected posts containing proprietary information, personal data, or embargoed material could be exposed to unauthorized users.
Likely Case
Contributors or authors gaining unauthorized access to other users' draft posts, potentially exposing editorial content, unpublished articles, or internal communications.
If Mitigated
With proper user role management and access controls, impact is limited to authorized users who already have some level of access to the WordPress admin area.
🎯 Exploit Status
Exploitation requires authenticated access to WordPress admin area with at least Contributor privileges. The vulnerability is in the mtphr_duplicate_post() function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.37
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Post Duplicator and click 'Update Now'. 4. Alternatively, download version 2.37+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable Post Duplicator Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate post-duplicator
Restrict User Roles
allTemporarily remove Contributor role access or limit user permissions
🧯 If You Can't Patch
- Disable the Post Duplicator plugin immediately
- Implement strict user role management and audit Contributor-level users
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → Post Duplicator version. If version is 2.36 or lower, you are vulnerable.Check Version:
wp plugin get post-duplicator --field=versionVerify Fix Applied:
After updating, verify Post Duplicator version shows 2.37 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Multiple post duplication actions by Contributor-level users
- Access to post IDs that user shouldn't have permissions for
- Unusual duplication of password-protected or private posts
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=mtphr_duplicate_post
- Admin area access from unexpected IPs
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" AND parameters.action="mtphr_duplicate_post")