CVE-2025-23764 Overview
CVE-2025-23764 is a Missing Authorization vulnerability [CWE-862] in the Copy Move Posts WordPress plugin developed by ujjavaljani. The flaw affects all versions from unspecified initial release through version 1.6. The plugin fails to enforce proper authorization checks, allowing unauthenticated network attackers to invoke restricted functionality without valid credentials. Successful exploitation results in limited integrity impact on affected WordPress sites. The vulnerability requires no user interaction and no privileges, making it accessible from any network position that can reach the target site.
Critical Impact
Unauthenticated attackers can trigger post copy or move operations on WordPress sites running Copy Move Posts version 1.6 or earlier, modifying site content without authorization.
Affected Products
- ujjavaljani Copy Move Posts plugin for WordPress
- All versions up to and including 1.6
- WordPress sites with the copy-move-posts plugin installed and activated
Discovery Timeline
- 2025-01-16 - CVE CVE-2025-23764 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23764
Vulnerability Analysis
The vulnerability is a broken access control issue in the Copy Move Posts WordPress plugin. The plugin exposes functionality to duplicate or move posts but does not verify that the requesting user holds the required capability or role. This omission classifies the flaw under [CWE-862] Missing Authorization. Attackers can invoke plugin endpoints directly over HTTP without authenticating to the WordPress instance. The impact is scoped to integrity, meaning attackers can alter content state but cannot directly exfiltrate confidential data or crash the site. Refer to the Patchstack Vulnerability Report for the disclosure details.
Root Cause
The root cause is the absence of capability checks such as current_user_can() and nonce verification via check_admin_referer() or wp_verify_nonce() on the plugin's action handlers. Without these checks, WordPress accepts any HTTP request reaching the vulnerable endpoint and executes the post copy or move logic.
Attack Vector
An attacker sends crafted HTTP requests to the plugin's action endpoints on the target WordPress site. Because no authentication or authorization gate exists, the plugin processes the request and performs the privileged operation on behalf of an anonymous caller. The attack requires only network reachability to the target site.
No verified public exploit code is available. See the Patchstack Vulnerability Report for further technical context.
Detection Methods for CVE-2025-23764
Indicators of Compromise
- Unexpected duplicated or relocated posts appearing in the WordPress database without corresponding administrator activity in audit logs.
- HTTP requests to Copy Move Posts plugin endpoints (such as admin-ajax.php actions or plugin-specific handlers) originating from unauthenticated sessions.
- Sudden spikes in wp_posts table writes correlated with external IP addresses not tied to editorial staff.
Detection Strategies
- Inventory WordPress plugins across managed sites and flag any installation of copy-move-posts at version 1.6 or earlier.
- Inspect web server access logs for POST requests targeting plugin action names with missing or empty authentication cookies.
- Enable WordPress audit logging plugins to record post creation and modification events with source IP and user context.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized SIEM for correlation of anonymous write activity against content management endpoints.
- Alert on admin-ajax.php calls that invoke plugin actions without a valid wordpress_logged_in_* cookie.
- Track plugin version drift so that outdated copy-move-posts installations surface for remediation.
How to Mitigate CVE-2025-23764
Immediate Actions Required
- Deactivate and remove the Copy Move Posts plugin from any WordPress site running version 1.6 or earlier until a patched release is confirmed.
- Review recent post activity for unauthorized duplication or relocation and restore correct content state from backups if tampering is identified.
- Restrict administrative endpoint access via web application firewall rules limiting admin-ajax.php to authenticated sessions where feasible.
Patch Information
At the time of the NVD entry, no fixed version beyond 1.6 is referenced in the available advisory data. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for an updated release that adds capability and nonce checks.
Workarounds
- Uninstall the plugin and use a maintained alternative that enforces WordPress capability checks on post duplication.
- Apply WAF signatures that block unauthenticated POST requests targeting copy-move-posts action parameters.
- Restrict access to /wp-admin/ paths by IP allowlist or authenticated reverse proxy until the plugin is patched or removed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
