CVE-2024-8123: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including…

PriorityP429medium5.4CVSS 3.1

AVNACLPRLUINSUCLILAN

EPSS

0.31%

22.5th percentile

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate posts written by other authors including admins. This includes the ability to duplicate password-protected posts, which reveals their contents.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wpextended	the_ultimate_wordpress_toolkit_wp_extended	<= 3.0.8	—
wpextended	wp_extended	< 3.0.9	3.0.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.