CVE-2024-12472 Overview
The Post Duplicator plugin for WordPress contains an information exposure vulnerability affecting all versions up to and including 2.36. The flaw resides in the mtphr_duplicate_post() function, which fails to enforce proper access controls on which posts a user can duplicate. Authenticated users with Contributor-level access or higher can duplicate password-protected, private, or draft posts belonging to other users. The duplication process exposes the full content of restricted posts to users who should not have access. This issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Contributor-level attackers can extract content from password-protected, private, and draft posts across the WordPress site, leading to unauthorized disclosure of unpublished or restricted editorial content.
Affected Products
- Metaphorcreations Post Duplicator plugin for WordPress
- All versions up to and including 2.36
- WordPress sites allowing Contributor-level accounts or above
Discovery Timeline
- 2025-01-11 - CVE-2024-12472 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12472
Vulnerability Analysis
The Post Duplicator plugin provides WordPress editors with a one-click action to clone existing posts. The mtphr_duplicate_post() function performs the duplication but does not validate whether the requesting user holds the permissions required to read the source post. WordPress enforces a layered permission model where draft, private, and password-protected posts are visible only to authorized roles. The plugin bypasses that model by reading the source post directly and writing its contents into a new post owned by the attacker. Because the resulting duplicate is editable by the attacker, the full content of the restricted source becomes readable. The flaw is categorized as an Insecure Direct Object Reference, since the post identifier submitted by the user is trusted without authorization checks.
Root Cause
The root cause is missing authorization in the duplication handler. The plugin accepts a post ID from an authenticated request and copies the corresponding post row without calling WordPress capability functions such as current_user_can('read_post', $post_id). Contributor accounts, which normally cannot read other users' drafts or private posts, can therefore operate on any post ID the server exposes.
Attack Vector
An authenticated attacker with at least Contributor privileges submits a duplicate request referencing a target post ID that belongs to another author. The plugin creates a new post containing the source content and assigns it to the attacker. The attacker then opens the duplicate in the WordPress editor to read protected content. See the Wordfence Vulnerability Analysis for technical details.
Detection Methods for CVE-2024-12472
Indicators of Compromise
- Newly created posts authored by Contributor accounts whose content matches existing private, draft, or password-protected posts owned by other users.
- Repeated calls to WordPress admin-ajax or admin-post endpoints invoking the mtphr_duplicate_post action from low-privileged accounts.
- Unexpected growth in post counts attributed to non-editor accounts shortly after installing or updating the plugin.
Detection Strategies
- Audit the wp_posts table for duplicate post_content values where the duplicate post_author differs from the original and holds a Contributor role.
- Review WordPress activity logs for mtphr_duplicate_post function invocations correlated with low-privileged sessions.
- Compare pre- and post-duplication authorship data to identify cross-author duplication events.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record post creation, duplication actions, and role-based activity.
- Forward web server access logs to a centralized log store and alert on POST requests to /wp-admin/admin-ajax.php or /wp-admin/post.php containing the mtphr_duplicate_post action from Contributor sessions.
- Monitor for installation of the Post Duplicator plugin at version 2.36 or earlier across managed WordPress fleets.
How to Mitigate CVE-2024-12472
Immediate Actions Required
- Update the Post Duplicator plugin to the version released after 2.36 that includes the authorization fix.
- Review Contributor and Author accounts for suspicious duplicated posts and remove unauthorized copies.
- Rotate passwords on any password-protected posts whose contents may have been exposed.
- Restrict Contributor-level account creation and enforce multi-factor authentication for all editorial roles.
Patch Information
The maintainer addressed the issue in the WordPress Plugin Changeset 3219375, which adds capability checks to the mtphr_duplicate_post() function. Administrators should install the latest version available in the WordPress plugin repository.
Workarounds
- Deactivate the Post Duplicator plugin until the patched version is deployed.
- Temporarily remove Contributor and Author roles from untrusted accounts or downgrade them to Subscriber.
- Place sensitive drafts in a staging environment that non-trusted contributors cannot access.
# Configuration example: update Post Duplicator via WP-CLI
wp plugin update post-duplicator
wp plugin get post-duplicator --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
