CVE-2023-4792 Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization to Post Duplication
MediumCVSS 4.3
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts and pages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inqsys Duplicate Post Page Menu & Custom Post Type | <= 2.3.1 | No fix listed |
| wordpress duplicate-post-page-menu-custom-post-type(WordPress) | < 2.4.0 | 2.4.0 |
References
- www.wordfence.com third-party-advisory
- plugins.trac.wordpress.org product
- plugins.trac.wordpress.org patch
- Wordfence Intelligence third-party-advisory
- www.cve.org