WordPress Plugin Vulnerabilities
Delete Duplicate Posts < 4.9 - Missing Authorization via AJAX Actions
Description
The Delete Duplicate Posts plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on some of its AJAX actions in all versions up to 4.9 (exclusive). This makes it possible for authenticated attackers, with subscriber access or higher, to delete duplicate posts, access plugin logs, and opt in to Freemius data gathering.
Affects Plugins
Fixed in 4.9 References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Huynh Tien Si
Verified
No
WPVDB ID
Timeline
Publicly Published
2023-11-13 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)
WPScan 