CVE-2025-13404 Overview
CVE-2025-13404 affects the atec Duplicate Page & Post plugin for WordPress in all versions up to and including 1.2.20. The plugin's duplicate_post() function lacks authorization validation, allowing authenticated users with Contributor-level access or above to duplicate arbitrary posts. This includes private and password-protected content, which results in unauthorized disclosure of sensitive material. The issue is categorized under CWE-862 (Missing Authorization). The vendor addressed the flaw in version 1.2.21.
Critical Impact
Authenticated attackers with Contributor privileges can duplicate private and password-protected WordPress posts, exposing confidential content stored on the site.
Affected Products
- atec Duplicate Page & Post plugin for WordPress — versions up to and including 1.2.20
- WordPress sites permitting Contributor-level or higher user registration
- Fixed in atec Duplicate Page & Post version 1.2.21
Discovery Timeline
- 2025-11-25 - CVE-2025-13404 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13404
Vulnerability Analysis
The vulnerability resides in the duplicate_post() function registered through the plugin's hook file atec-wpdpp-hooks.php. The function processes duplication requests without verifying whether the calling user has permission to read the target post. WordPress differentiates access using capabilities such as read_private_posts and edit_others_posts, but the plugin bypasses those checks entirely. Any authenticated user meeting the minimum Contributor threshold can trigger duplication of any post ID on the site.
Because the duplicated post is created as a new object owned or viewable by the requester, the attacker gains full read access to the original content, including drafts, private posts, and password-protected articles. Password protection in WordPress relies on runtime checks against the stored password, but duplication copies the underlying content directly, sidestepping the protection layer.
Root Cause
The root cause is the absence of a current_user_can() capability check within the duplicate_post() handler. The function trusts the caller once basic authentication is confirmed and does not validate ownership or visibility of the target post before cloning it.
Attack Vector
Exploitation requires authenticated access at Contributor level or above. An attacker submits a duplication request referencing a post ID they should not be able to read. The plugin executes the copy operation and returns a new post containing the private content. The technical details of the vulnerable hook are documented in the WordPress Plugin Hook Source for version 1.2.20 and the fixed version at the 1.2.21 hook source.
Detection Methods for CVE-2025-13404
Indicators of Compromise
- Unexpected duplicate posts appearing in the WordPress database with content matching private or password-protected originals.
- Duplication requests to admin-ajax endpoints or plugin routes originating from Contributor-level accounts.
- New post entries authored by low-privilege users referencing post IDs they do not own.
Detection Strategies
- Audit the wp_posts table for recently created posts whose content mirrors existing private or protected entries.
- Review WordPress activity logs for calls to the duplicate_post action executed by non-administrative roles.
- Correlate web server access logs with plugin endpoints to identify duplication requests from unexpected user sessions.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record post creation events with user attribution.
- Alert on any post creation activity by Contributor accounts referencing posts they did not originally author.
- Track plugin version inventories across managed WordPress sites and flag installations still running 1.2.20 or earlier.
How to Mitigate CVE-2025-13404
Immediate Actions Required
- Update the atec Duplicate Page & Post plugin to version 1.2.21 or later on all WordPress installations.
- Review Contributor and Author accounts for legitimacy and remove unused or suspicious users.
- Inspect existing posts for unauthorized duplicates of private or password-protected content.
Patch Information
The vendor released version 1.2.21 of the atec Duplicate Page & Post plugin, which adds the missing authorization validation to the duplicate_post() function. Refer to the Wordfence Vulnerability Report for advisory details and the patched hook source at version 1.2.21 for the code-level fix.
Workarounds
- Deactivate the atec Duplicate Page & Post plugin until the patched version can be deployed.
- Restrict new user registration and limit Contributor-level access to trusted individuals.
- Apply a web application firewall rule to block duplication requests from users below Editor role.
# Update the plugin via WP-CLI to the patched release
wp plugin update atec-duplicate-page-post --version=1.2.21
wp plugin list --name=atec-duplicate-page-post --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
