CVE-2021-25075 Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS
Authenticated users or CSRF attackers can modify plugin settings and inject stored XSS due to missing authorization and flawed CSRF checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-25075?
CVE-2021-25075 is a low-severity missing authorization vulnerability in Unknown Duplicate Page or Post, published on 21 Feb 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
Weakness: CWE-862
Which versions are affected by CVE-2021-25075?
It affects 1 product.
Products include Wpdevart Duplicate Page or Post.
How do I fix CVE-2021-25075?
No fix has been published for CVE-2021-25075 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-25075 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-25075 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-mm58-v9gq-hfr3.