WordPress Plugin Vulnerabilities

Trash Duplicate and 301 Redirect < 1.9.1 - Unauthenticated Arbitrary Post Deletion

Description

The plugin is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-action-top' action. This makes it possible for unauthenticated attackers to delete arbitrary posts/pages.

Affects Plugins

Plugin icon
trash-duplicate-and-301-redirect
Fixed in 1.9.1

References

CVE
CVE-2024-13468
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb6afd7-6bc4-4c8a-a645-04f64d5adff4

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Krzysztof Zając
Verified
No
WPVDB ID
f6602520-643a-438d-b04b-c71f80f22964

Timeline

Publicly Published
2025-02-18 (about 1 year ago)
Added
2025-02-18 (about 1 year ago)
Last Updated
2025-08-18 (about 11 months ago)

Other

Published
Title
Published
2025-09-26
Title
EmailKit < 1.6.1 - Missing Authorization to Authenticated (Author+) Arbitrary Content Deletion
Published
2025-03-31
Title
Slider Path for Elementor <= 3.0.0 - Missing Authorization
Published
2024-08-26
Title
Droip < 2.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Change
Published
2025-01-31
Title
Shortcodes and extra features for Phlox theme < 2.17.5 - Missing Authorization
Published
2025-03-13
Title
Resido - Real Estate WordPress Theme < 3.6.1 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update