Unauthorized Post Duplication Vulnerability in Themify Builder Plugin

CVE-2024-7836

Summary

The Themify Builder plugin for WordPress is susceptible to a security flaw that enables authenticated users, including those with Contributor-level permissions, to duplicate and access posts that should remain private or in draft form. This issue arises due to inadequate verification within the duplicate_page_ajaxify function in all versions up to and including 7.6.1. As a result, users may exploit this vulnerability to gain access to content created by other authors without proper authorization.

References