CVE-2024-5942

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5942
The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19 Product
https://plugins.trac.wordpress.org/changeset/3108149/ Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19 Product
https://plugins.trac.wordpress.org/changeset/3108149/ Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:carlosfazenda:page_and_post_clone:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 09:48

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.4 		v2 : unknown
v3 : 4.3
References () https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19 - Product () https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19 - Product
References () https://plugins.trac.wordpress.org/changeset/3108149/ - Patch () https://plugins.trac.wordpress.org/changeset/3108149/ - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve - Third Party Advisory

09 Jul 2024, 16:02

Type Values Removed Values Added
First Time Carlosfazenda page And Post Clone
Carlosfazenda
CPE cpe:2.3:a:carlosfazenda:page_and_post_clone:*:*:*:*:*:wordpress:*:*
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 5.4
References () https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19 - () https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19 - Product
References () https://plugins.trac.wordpress.org/changeset/3108149/ - () https://plugins.trac.wordpress.org/changeset/3108149/ - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve - Third Party Advisory
CWE CWE-639

01 Jul 2024, 12:37

Type Values Removed Values Added
Summary
  • (es) El complemento Page and Post Clone para WordPress es vulnerable a Insecure Direct Object Reference en todas las versiones hasta la 6.0 incluida a través de la función 'content_clone' debido a la falta de validación en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de autor y superior, clonen y lean publicaciones privadas.

29 Jun 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-29 05:15

Updated : 2024-11-21 09:48

NVD link : CVE-2024-5942

Mitre link : CVE-2024-5942

CVE.ORG link : CVE-2024-5942

JSON object : View

Products Affected

carlosfazenda

  • page_and_post_clone
CWE
CWE-639

Authorization Bypass Through User-Controlled Key