CVE-2025-24736

Executive Summary

CVE-2025-24736 is a Missing Authorization vulnerability in the WordPress plugin Post Duplicator by Metaphorcreations. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions such as duplicating posts without proper permissions. The vulnerability affects all versions from n/a through 2.35. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood currently. No public proof-of-concept or patch details are available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed Post Duplicator from the WordPress dashboard or via direct download are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Unauthorized modification of data (post duplication).
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the impact is limited to unauthorized post duplication, this could be used to create spam content, bypass editorial workflows, or as a stepping stone for further attacks.

Deep Dive & Mechanics

The vulnerability resides in the Post Duplicator WordPress plugin, which provides functionality to duplicate posts, pages, and custom post types. The plugin fails to properly enforce authorization checks on its AJAX actions or REST endpoints, allowing unauthenticated users to trigger the duplication process.

Root Cause: The plugin uses wp_ajax_ and wp_ajax_nopriv_ hooks without verifying user capabilities. The nopriv hook allows unauthenticated access, and the missing current_user_can() check means any visitor can invoke the duplication function.

Attack Vector: An attacker sends a crafted HTTP request to the WordPress site, targeting the plugin's AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=pd_duplicate_post). The request includes the post ID to duplicate. The plugin processes the request without verifying the user's role or permissions.

Impact: The attacker can duplicate any post, page, or custom post type on the site. This could lead to:

• Creation of spam or malicious content.
• Bypassing content approval workflows.
• Exhaustion of server resources (if many duplicates are created).
• Potential information disclosure if duplicated posts contain sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the likely vulnerable code pattern.

Vulnerable Code (hypothetical):

add_action('wp_ajax_pd_duplicate_post', 'pd_duplicate_post_handler');
add_action('wp_ajax_nopriv_pd_duplicate_post', 'pd_duplicate_post_handler');

function pd_duplicate_post_handler() {
    $post_id = intval($_POST['post_id']);
    // Missing capability check
    $post = get_post($post_id);
    // Duplicate logic...
    wp_die();
}

Patched Code (expected):

add_action('wp_ajax_pd_duplicate_post', 'pd_duplicate_post_handler');
// Remove the nopriv hook to prevent unauthenticated access
// add_action('wp_ajax_nopriv_pd_duplicate_post', 'pd_duplicate_post_handler');

function pd_duplicate_post_handler() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    // Duplicate logic...
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Post Duplicator plugin version <= 2.35.
• Knowledge of a valid post ID to duplicate.

Exploitation Steps:

1. Identify the AJAX action used by the plugin (e.g., pd_duplicate_post).
2. Send a POST request to /wp-admin/admin-ajax.php with the action and post ID.
3. Verify the duplicate post is created.

Example cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=pd_duplicate_post&post_id=123"

Expected Output: A new post with a similar title (e.g., "Original Post (Copy)") is created.

Blue Team

Detection:

• Monitor for unusual spikes in post creation activity.
• Look for requests to admin-ajax.php with action parameters related to Post Duplicator from unauthenticated sources.
• Check server logs for POST requests to /wp-admin/admin-ajax.php with action=pd_duplicate_post.

Hunting:

• Search for posts with titles containing "(Copy)" or similar suffixes created by unknown users.
• Review user roles and capabilities for any unexpected changes.

Mitigation:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to the plugin's AJAX endpoints.
• Use a security plugin to enforce capability checks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=pd_duplicate_post from unauthenticated IPs.
  • Repeated requests with different post_id values.
• File System:
  • Unexpected duplicate posts in the WordPress database.
  • Log entries showing pd_duplicate_post action without a valid user session.
• Behavioral:
  • Sudden increase in post count.
  • Posts with titles ending in "(Copy)" or similar patterns.

Detection Engineering

YARA Rule

rule Detect_Post_Duplicator_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-24736 in Post Duplicator plugin"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $ajax_action = "pd_duplicate_post"
        $admin_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: Post Duplicator Unauthenticated AJAX Exploit
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated requests to Post Duplicator AJAX endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=pd_duplicate_post'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24736 Post Duplicator Unauthenticated AJAX Exploit"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=pd_duplicate_post"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and remove any unauthorized duplicate posts created by the exploit.
3. Audit user accounts for any signs of compromise.

Long-term Fix:

• Apply the official patch from Metaphorcreations once available.
• Implement proper capability checks in custom WordPress plugins.
• Use a security plugin like Wordfence or Sucuri to add an additional layer of protection.

Workaround:

• Add a custom function to your theme's functions.php to block unauthenticated access to the plugin's AJAX endpoints:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        if (isset($_POST['action']) && strpos($_POST['action'], 'pd_') === 0) {
            if (!is_user_logged_in()) {
                wp_die('Unauthorized', 403);
            }
        }
    }
});

Valters IT
Securing Digital Frontiers