CVE-2024-1368 Overview
CVE-2024-1368 affects the Page Duplicator plugin for WordPress developed by samuelkwle. The vulnerability stems from a missing capability check on the duplicate_dat_page() function. All versions up to and including 0.1.1 are affected. Unauthenticated attackers can duplicate arbitrary posts and pages on affected sites without any authentication or user interaction. The flaw is categorized as Missing Authorization [CWE-862] and is exploitable over the network with low complexity.
Critical Impact
Unauthenticated attackers can duplicate arbitrary posts and pages, including private or draft content, leading to potential exposure of unpublished material and integrity issues within the content management system.
Affected Products
- Samuelkwle Page Duplicator plugin for WordPress
- All versions up to and including 0.1.1
- WordPress sites with the wp-page-duplicator plugin active
Discovery Timeline
- 2024-02-28 - CVE-2024-1368 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1368
Vulnerability Analysis
The Page Duplicator plugin exposes an action handler that allows duplication of WordPress posts and pages. The handler duplicate_dat_page() is registered without an accompanying capability check. WordPress relies on functions such as current_user_can() to enforce authorization for administrative actions. Because the plugin omits this check, any HTTP request that reaches the handler executes the duplication logic. Attackers do not need valid credentials to trigger the function.
This behavior enables unauthorized modification of site content by inserting duplicate entries into the WordPress database. Duplicated items may include drafts, pending posts, or private pages that would normally require editor or administrator privileges to access.
Root Cause
The root cause is a Missing Authorization weakness [CWE-862] in the duplicate_dat_page() function located in page-duplicator.php at line 136. The function does not verify user capabilities or validate a nonce before performing the duplication operation. The plugin author registered the action but did not gate execution behind current_user_can('edit_posts') or an equivalent check.
Attack Vector
An attacker sends a crafted HTTP request to the WordPress site targeting the plugin's registered action. Because no authentication is required, the request can originate from any network-reachable client. The server processes the request and creates a duplicate of the specified post or page. Repeated requests can be used to populate the site with unwanted duplicate content or to surface content that was not intended to be public.
No verified public exploit code is available. Technical details are documented in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-1368
Indicators of Compromise
- Unexpected duplicate posts or pages appearing in the WordPress database with matching titles and slugs suffixed by duplication markers
- Web server access logs showing unauthenticated POST or GET requests to WordPress admin-ajax.php or plugin action endpoints referencing the duplicator action
- Sudden increases in the wp_posts table row count without corresponding activity from authenticated editors
Detection Strategies
- Inventory WordPress installations and identify sites running the Page Duplicator plugin at version 0.1.1 or earlier
- Review WordPress activity logs and database audit trails for post creation events lacking an associated authenticated user
- Correlate web access logs with post creation timestamps to identify unauthenticated requests that triggered duplication
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture post creation, modification, and user context in real time
- Forward web server logs to a centralized SIEM for detection of anomalous request patterns targeting plugin endpoints
- Alert on rapid successive post creation events originating from a single source IP address
How to Mitigate CVE-2024-1368
Immediate Actions Required
- Deactivate and remove the Page Duplicator plugin until a patched version is published by the vendor
- Audit the wp_posts table for unauthorized duplicate entries and remove any that were not created by legitimate editors
- Restrict access to WordPress admin endpoints using web application firewall rules or IP allowlisting
Patch Information
At the time of the NVD entry, no patched version is identified. All versions up to and including 0.1.1 remain vulnerable. Administrators should monitor the plugin repository for an updated release that adds a capability check and nonce validation to the duplicate_dat_page() function. Refer to the WordPress Plugin Code Review for the affected code path.
Workarounds
- Uninstall the plugin entirely if duplication functionality is not required for site operations
- Deploy a web application firewall rule that blocks unauthenticated requests to the plugin's action handler
- Replace the plugin with a maintained alternative that implements proper capability checks and nonce validation
# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate wp-page-duplicator
wp plugin delete wp-page-duplicator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.