Executive brief
Easy Twitter Feeds is a WordPress plugin used to display social media content on websites. A security flaw allows an attacker to trick a site administrator into clicking a malicious link, which then automatically duplicates posts or pages without their consent. This could lead to unauthorized content creation and cluttering of the website's management interface.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'duplicate_post' action handler of the Easy Twitter Feeds plugin for WordPress. The issue stems from a lack of cryptographic nonce verification, which is required to validate that a request was intentionally initiated by a legitimate user. An unauthenticated remote attacker can exploit this by inducing an authenticated administrator to interact with a specially crafted URL or web page. Successful exploitation allows the attacker to trigger the duplication of arbitrary posts or pages on the WordPress site. The vulnerability is addressed in version 1.2.13.
Affected products
- bPlugins Easy Twitter Feeds < 1.2.13
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory