CVE-2024-12472: falha de média gravidade em metaphorcreations Post Duplicator
Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
metaphorcreations · Post DuplicatorCVEs relacionadas — metaphorcreations Post Duplicator
No mesmo produto, das mais perigosas para as menos.
CVE-2026-39474HIGHWordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-4245MEDIUMPost Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post DuplicationEPSS 0.4%CVE-2025-24736MEDIUMWordPress Post Duplicator plugin <= 2.35 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-4244MEDIUMPost Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author AttributionEPSS 0.3%CVE-2026-2301MEDIUMPost Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' ParameterEPSS 0.2%