Information Exposure in Post Duplicator Plugin for WordPress

CVE-2024-12472

Summary

The Post Duplicator plugin for WordPress, present in all versions up to 2.36, suffers from an information exposure vulnerability due to inadequate restrictions within the mtphr_duplicate_post() function. This flaw permits authenticated attackers, who possess Contributor-level access or higher, to illicitly duplicate posts that are meant to be secure, including password-protected, private, or draft posts. As a consequence, these attackers can access sensitive data that should remain inaccessible to them, raising significant concerns regarding the security measures in place.

References