CVE-2024-13468: WordPress Plugin Auth Bypass Vulnerability

CVE-2024-13468 Overview

CVE-2024-13468 is a missing authorization vulnerability in the Trash Duplicate and 301 Redirect plugin for WordPress. The flaw affects all versions up to and including 1.9. The plugin fails to perform a capability check on the duplicates-action-top action. Unauthenticated attackers can exploit this gap over the network to delete arbitrary posts and pages on affected WordPress sites. The issue is categorized as a broken access control weakness [CWE-862] and primarily impacts data integrity.

Critical Impact
Unauthenticated remote attackers can delete arbitrary posts and pages on any WordPress site running Trash Duplicate and 301 Redirect plugin version 1.9 or earlier, causing data loss and content destruction.

Affected Products

Trash Duplicate and 301 Redirect WordPress plugin — all versions through 1.9
WordPress sites with the plugin active and exposed to the internet
Multi-site WordPress deployments where the plugin is network-enabled

Discovery Timeline

2025-02-19 - CVE-2024-13468 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13468

Vulnerability Analysis

The vulnerability stems from a missing capability check on the duplicates-action-top action handler within the Trash Duplicate and 301 Redirect plugin. WordPress plugins are expected to verify that the requesting user holds the appropriate capability before performing destructive operations. This plugin omits that verification entirely. As a result, anyone able to reach the WordPress administrative request endpoints can trigger the bulk action and delete content.

The attack requires no authentication, no user interaction, and no special privileges. The Exploit Prediction Scoring System (EPSS) places the probability of exploitation at 0.502%. While not classified as a code execution flaw, the impact on site availability and editorial workflows can be substantial for sites that rely on the plugin.

Root Cause

The root cause is the absence of a current_user_can() capability check and a nonce verification on the duplicates-action-top action. WordPress provides built-in primitives such as check_admin_referer() and capability constants like delete_posts and delete_others_posts to gate destructive operations. The plugin processes the action request and performs the deletion without invoking either control, allowing the request to be issued by any unauthenticated client.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable WordPress endpoint that handles the duplicates-action-top action, specifying the post identifiers to delete. Because the handler does not validate the requester, the server processes the deletion as if it came from an authorized administrator. Attackers can enumerate post IDs from public archives, RSS feeds, or the REST API, and then issue sequential delete requests to wipe content at scale.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-13468

Indicators of Compromise

Unexpected HTTP POST or GET requests containing the parameter duplicates-action-top from unauthenticated sessions.
Unexplained transitions of posts or pages to the trash status in the wp_posts table without corresponding administrator activity in audit logs.
Spikes in 200-status responses to wp-admin endpoints originating from IP addresses with no prior authenticated session cookies.

Detection Strategies

Inspect WordPress access logs for requests referencing duplicates-action-top that lack a valid wordpress_logged_in_* cookie.
Query the wp_posts table for bulk post_status changes to trash clustered in short time windows.
Correlate web server logs with WordPress audit plugins to identify deletions that have no corresponding administrative login event.

Monitoring Recommendations

Enable WordPress activity logging plugins to record post and page deletion events with user attribution.
Forward web server and application logs to a centralized SIEM for alerting on the duplicates-action-top parameter.
Set up integrity monitoring that alerts when published post counts drop by more than a defined threshold within a short interval.

How to Mitigate CVE-2024-13468

Immediate Actions Required

Deactivate the Trash Duplicate and 301 Redirect plugin until a patched version is confirmed installed.
Restore deleted posts from the WordPress trash or from database backups if content loss has occurred.
Restrict access to wp-admin endpoints by IP allowlist or via a web application firewall while remediation is in progress.

Patch Information

Review the WordPress Plugin Change Log for the commit that addresses the missing capability check. Refer to the WordPress Plugin Details page to confirm the latest available version and update accordingly. Apply the update through the WordPress administrative dashboard or via WP-CLI using wp plugin update trash-duplicate-and-301-redirect.

Workarounds

Block requests containing the duplicates-action-top parameter at the web application firewall or reverse proxy layer.
Remove the plugin entirely if the duplicate-handling functionality is not in active use.
Implement WordPress role hardening so that only trusted administrators retain delete_posts and delete_others_posts capabilities.

bash

# Example WAF rule (ModSecurity) to block unauthenticated requests targeting the vulnerable action
SecRule ARGS_NAMES "@streq duplicates-action-top" \
  "id:1004862,phase:2,deny,status:403,log,\
   msg:'CVE-2024-13468 - Block unauthenticated duplicates-action-top requests',\
   chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"