Unauthorized Data Modification in Yoast Duplicate Post Plugin

Executive Summary

The Yoast Duplicate Post plugin for WordPress has a vulnerability due to missing capability checks in two key functions: clone_bulk_action_handler() and republish_request(). This flaw allows authenticated users with Contributor-level access or higher to duplicate any post on the site, including private, draft, and trashed posts they normally should not access.

Additionally, users with Author-level access or higher can exploit the Rewrite & Republish feature to overwrite any published post with their own content, effectively modifying posts they do not own or control.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves unauthorized modification of posts via the Yoast Duplicate Post plugin for WordPress, specifically through the clone_bulk_action_handler() and republish_request() functions. Detection would involve monitoring for unusual bulk cloning or rewrite & republish actions initiated by users with Contributor-level access or higher.'}, {'type': 'paragraph', 'content': 'Since the vulnerability exploits WordPress admin bulk actions, you can detect it by auditing WordPress admin logs for bulk duplication or rewrite & republish actions, especially those performed by users with Contributor or Author roles.'}, {'type': 'paragraph', 'content': 'Suggested commands or methods include:'}, {'type': 'list_item', 'content': 'Check WordPress audit logs or activity logs for bulk actions named "duplicate_post_bulk_clone" or "duplicate_post_bulk_rewrite_republish".'}, {'type': 'list_item', 'content': 'Use WP-CLI to list recent post duplications or modifications by users with Contributor or Author roles.'}, {'type': 'list_item', 'content': 'Example WP-CLI command to list recent posts duplicated or modified (requires custom scripting or logging):'}, {'type': 'list_item', 'content': 'wp post list --post_type=post --meta_key=_dp_has_been_republished --meta_compare=EXISTS'}, {'type': 'list_item', 'content': 'Monitor HTTP requests to the WordPress admin interface for POST requests triggering bulk clone or rewrite & republish actions.'}, {'type': 'paragraph', 'content': "Note: The provided resources do not include explicit detection commands, so these suggestions are based on the plugin's behavior and typical WordPress monitoring practices."}] [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized duplication and modification of posts on a WordPress site using the Yoast Duplicate Post plugin. An attacker with Contributor-level access can duplicate sensitive or restricted posts, potentially exposing private or draft content.

More critically, an attacker with Author-level access can overwrite published posts with malicious or unauthorized content using the Rewrite & Republish feature, which can damage the integrity and trustworthiness of the website's content.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediate steps include:

• Update the Yoast Duplicate Post plugin to a version later than 4.5 where the missing capability checks are fixed.
• Restrict Contributor-level and Author-level user permissions to prevent unauthorized access to duplication and rewrite & republish features.
• Temporarily disable or restrict bulk cloning and rewrite & republish actions in the plugin settings or by removing the plugin if an update is not immediately available.
• Monitor and audit user actions related to post duplication and republishing to detect any unauthorized activity.

These steps help prevent attackers with lower-level access from duplicating or overwriting posts they should not have access to.

Useful 0 Not Useful 0