Authenticated Attackers Can Duplicate Posts, Including Password-Protected Ones, Exposing Contents

CVE-2024-8123

Summary

The WP Extended plugin for WordPress is prone to an Insecure Direct Object Reference (IDOR) vulnerability due to inadequate validation of user-controlled input in the duplicate_post function. This flaw impacts all versions up to and including 3.0.8. Authenticated users with Contributor-level access or higher can exploit this vulnerability to duplicate posts authored by other users, including administrators. This capability extends to password-protected posts, causing the unintended exposure of their confidential content. This vulnerability underscores the critical need for proper input validation in WordPress plugins to safeguard user data and maintain content integrity.

References