CVE-2024-12538

Executive Summary

CVE-2024-12538 is a Sensitive Information Exposure vulnerability in the WordPress plugin "Duplicate Post, Page and Any Custom Post" (versions up to and including 3.5.5). The flaw resides in the dpp_duplicate_as_draft function, which allows authenticated attackers with Contributor-level access or higher to duplicate and thereby read the content of draft, scheduled (future), private, and password-protected posts. This bypasses the intended access controls of WordPress, exposing potentially sensitive data such as unpublished content, internal notes, or password-protected material.

The vulnerability has a CVSS score of 4.3 (Medium) and a very low EPSS score (0.0%), indicating it is not currently being actively exploited in the wild. However, given the widespread use of this plugin, the risk of targeted exploitation remains.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem supply chain. Users are advised to monitor the plugin's update channel for a patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a Contributor-level account or higher.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (U:S) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Only limited sensitive information is exposed.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires authentication but is trivial to exploit once access is obtained. It can lead to the leakage of unpublished or private content.

Deep Dive & Mechanics

The vulnerability exists in the dpp_duplicate_as_draft function, which is responsible for duplicating posts. The function does not properly check the post's visibility status before allowing duplication. Specifically, it fails to verify whether the original post is in a draft, scheduled, private, or password-protected state. As a result, an authenticated user with Contributor-level access (who normally cannot view private or future posts) can duplicate such posts and then read the duplicated draft.

Root Cause: The function uses wp_insert_post to create a duplicate but does not enforce the same access control checks that WordPress applies when viewing a post. The duplication process copies the post content, title, and metadata without verifying the user's capability to read the original.

Attack Flow:

1. An attacker authenticates as a Contributor (or higher) on the WordPress site.
2. The attacker sends a POST request to the admin-ajax endpoint with the action dpp_duplicate_as_draft and the ID of a target post (e.g., a private post).
3. The plugin duplicates the post, creating a new draft with the same content.
4. The attacker can then view the duplicated draft, which is now accessible because it is in draft status.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.5.5):

function dpp_duplicate_as_draft() {
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    // No capability check for reading the original post
    $new_post = array(
        'post_title'   => $post->post_title,
        'post_content' => $post->post_content,
        'post_status'  => 'draft',
        'post_author'  => get_current_user_id(),
    );
    $new_post_id = wp_insert_post($new_post);
    echo $new_post_id;
    wp_die();
}

Patched Code (hypothetical fix):

function dpp_duplicate_as_draft() {
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    // Check if the user can read the original post
    if (!current_user_can('read_post', $post_id)) {
        wp_die('You do not have permission to duplicate this post.');
    }
    $new_post = array(
        'post_title'   => $post->post_title,
        'post_content' => $post->post_content,
        'post_status'  => 'draft',
        'post_author'  => get_current_user_id(),
    );
    $new_post_id = wp_insert_post($new_post);
    echo $new_post_id;
    wp_die();
}

The fix adds a capability check using current_user_can('read_post', $post_id) to ensure the user has permission to view the original post before duplicating it.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the vulnerable plugin installed (version <= 3.5.5).
• A user account with Contributor-level access or higher.
• The ID of a target post (e.g., a private or scheduled post).

Exploitation Steps:

1. Log in as the Contributor user.
2. Obtain the nonce for the AJAX action (if required). The plugin may use a nonce, but it is often not validated.
3. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: dpp_duplicate_as_draft
   • post_id: <target_post_id>
4. The response will contain the ID of the newly created draft.
5. Navigate to /wp-admin/post.php?post=<new_draft_id>&action=edit to view the duplicated content.

Example cURL command:

curl -X POST 'http://target-site.com/wp-admin/admin-ajax.php' \
  -d 'action=dpp_duplicate_as_draft&post_id=123' \
  --cookie 'wordpress_logged_in_<hash>=<session_cookie>'

Blue Team (Detection & Prevention)

Detection:

• Monitor AJAX requests to admin-ajax.php with the action dpp_duplicate_as_draft from low-privileged users.
• Look for rapid duplication of posts that are not normally accessible to the user (e.g., private or scheduled posts).
• Check for unusual patterns in post duplication, such as a Contributor duplicating many posts in a short time.

Prevention:

• Apply the patch as soon as it becomes available.
• Restrict Contributor-level access to only necessary users.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Implement additional logging for post duplication actions.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=dpp_duplicate_as_draft and a post_id parameter.
• Logs: WordPress debug logs showing dpp_duplicate_as_draft function calls from unexpected user roles.
• File: Presence of duplicated draft posts that mirror private or scheduled posts.
• User: Contributor accounts creating multiple drafts in a short period.

Detection Engineering

YARA Rule

rule CVE_2024_12538_WordPress_Duplicate_Post
{
    meta:
        description = "Detects exploitation attempts of CVE-2024-12538 in WordPress Duplicate Post plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12538"
    strings:
        $ajax_action = "dpp_duplicate_as_draft"
        $post_id = "post_id="
    condition:
        $ajax_action and $post_id
}

Sigma Rule

title: CVE-2024-12538 WordPress Duplicate Post Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2024-12538 via AJAX requests
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=dpp_duplicate_as_draft'
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12538 WordPress Duplicate Post Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=dpp_duplicate_as_draft"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review user roles and remove Contributor access from untrusted users.
3. Audit logs for any signs of exploitation (e.g., duplicated private posts).

Long-term Fix:

• Apply the official patch from the plugin vendor once available.
• Implement a Web Application Firewall (WAF) rule to block the vulnerable AJAX action.
• Educate users about the risks of granting low-level access to sensitive content.

Workaround:

• Use a custom plugin or code snippet to add a capability check to the dpp_duplicate_as_draft function.

Valters IT