CVE-2025-24736 Overview
CVE-2025-24736 is a Missing Authorization vulnerability in the metaphorcreations Post Duplicator plugin for WordPress. The flaw affects all plugin versions up to and including 2.35. The plugin fails to enforce proper capability checks, allowing authenticated users with low-privilege roles to invoke duplication functionality that should be restricted to higher-privileged accounts. The weakness is categorized under [CWE-862] Missing Authorization.
Critical Impact
Authenticated attackers with minimal privileges can abuse the plugin's duplication functionality due to incorrectly configured access control, resulting in unauthorized modification of site content.
Affected Products
- Metaphorcreations Post Duplicator plugin for WordPress
- All versions from n/a through 2.35
- WordPress installations with the plugin activated
Discovery Timeline
- 2025-01-24 - CVE-2025-24736 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24736
Vulnerability Analysis
The Post Duplicator plugin exposes functionality that duplicates WordPress posts and pages. The plugin does not correctly verify whether the requesting user holds the capabilities required to invoke this functionality. As a result, low-privilege authenticated users can trigger duplication actions intended for editors or administrators.
The vulnerability requires network access and low privileges, with no user interaction. Exploitation impacts data integrity by permitting unauthorized content duplication. Confidentiality and availability are not directly affected.
Root Cause
The root cause is a Missing Authorization weakness [CWE-862]. The plugin's request handlers do not perform sufficient capability checks such as current_user_can() before executing sensitive operations. Access control decisions rely on incorrectly configured security levels rather than WordPress role and capability enforcement.
Attack Vector
An attacker authenticates to the target WordPress site with any low-privilege account, such as Subscriber or Contributor. The attacker then issues requests to the plugin endpoints responsible for post duplication. Because authorization checks are missing or misconfigured, the requests succeed and duplicate content the user should not be able to create.
No verified public exploit code or proof-of-concept has been published. Refer to the Patchstack Vulnerability Report for additional technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-24736
Indicators of Compromise
- Unexpected duplicate posts, pages, or custom post types appearing in the WordPress database
- admin-ajax.php or plugin action requests originating from low-privilege authenticated accounts
- Sudden increase in draft or duplicated content created by Subscriber or Contributor accounts
Detection Strategies
- Review WordPress audit logs for post creation events attributed to users lacking editorial capabilities
- Correlate HTTP request logs against user roles to identify privilege mismatches on plugin endpoints
- Inspect the wp_posts table for near-identical entries created within short intervals by non-editor accounts
Monitoring Recommendations
- Enable an activity logging plugin to capture post lifecycle events with user attribution
- Forward WordPress and web server logs to a centralized SIEM for role-based anomaly analysis
- Alert on any low-privilege user invoking Post Duplicator action handlers
How to Mitigate CVE-2025-24736
Immediate Actions Required
- Deactivate the Post Duplicator plugin until a patched version is confirmed installed
- Audit user accounts and remove or downgrade unnecessary low-privilege accounts
- Review recently created posts and remove unauthorized duplicates
Patch Information
No fixed version is listed in the enriched CVE data at the time of publication. Administrators should monitor the Patchstack Vulnerability Report and the plugin's official WordPress.org listing for a release addressing CVE-2025-24736 in a version above 2.35.
Workarounds
- Restrict access to wp-admin and admin-ajax.php via web application firewall rules that block plugin actions from low-privilege roles
- Disable open user registration if the site does not require public account creation
- Apply virtual patching through a WAF vendor that maintains signatures for CVE-2025-24736
# Configuration example: disable open registration and deactivate the plugin via WP-CLI
wp option update users_can_register 0
wp plugin deactivate post-duplicator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
