Duplicate Post, 5a2753abf1631c3e7f5fe59f00f3453a726e7b9f

CVE, Research URL: 5a2753abf1631c3e7f5fe59f00f3453a726e7b9f
Home page URL: Security reports for Duplicate Post
Application: Duplicate Post
Published on: Aug 03, 2023
Research Description: Duplicate Post [copy-delete-posts] < 1.4.2 Duplicate Post <= 1.4.1 - Cross-Site Request Forgery via 'cdp_action_handling' AJAX action The Duplicate Post plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.1. This is due to missing or incorrect nonce validation on the 'cdp_action_handling' AJAX action. This makes it possible for unauthenticated attackers to change plugin settings, duplicate posts, and make use of other restricted functionalities via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 1.4.2.
Status: vulnerable