Duplicate Post Plugin Slug Takeover via Unauthorized Post Editing

Executive Summary

This vulnerability in the Duplicate Post WordPress plugin before version 1.5.8 allows users with limited roles, such as Contributors, to take over post slugs. When the slug takeover option is enabled, the plugin does not check if the user duplicating a post has permission to edit it. This lets the user publish their own copy of a post at the original permalink address, effectively moving the original post off its URL.

Useful 0 Not Useful 0

Detection Guidance

Check if the Duplicate Post WordPress plugin version is below 1.5.8. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details in the plugin header.

Useful 0 Not Useful 0

Impact Analysis

If you use the Duplicate Post plugin before version 1.5.8, an attacker with a Contributor role or similar limited access could overwrite existing posts by publishing their own content at the same URL. This could lead to misinformation, reputational damage, or disruption of your website's content.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Duplicate Post plugin to version 1.5.8 or later immediately. Disable the slug takeover feature if not required. Review user roles with post editing permissions to ensure least privilege.

Useful 0 Not Useful 0