Clone Vulnerability – Missing Authorization – CVE-2024-31435 | WordPress Plugin Vulnerability Report

Plugin Name: Clone

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-clone-by-wp-academy
  • Software Status: Active
  • Software Author: migrate
  • Software Downloads: 3,222,101
  • Active Installs: 80,000
  • Last Updated: April 24, 2024
  • Patched Versions: 2.4.4
  • Affected Versions: <= 2.4.3

Vulnerability Details:

  • Name: Inisev Analyst Module <= 2.4.3
  • Title: Missing Authorization
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-31435
  • CVSS Score: 4.3
  • Publicly Published: April 10, 2024
  • Researcher: Dhabaleshwar Das
  • Description: Multiple plugins and/or themes by Inisev for WordPress are vulnerable to unauthorized access due to missing capability checks on several functions in various versions. This vulnerability allows authenticated attackers, with subscriber-level access or above, to perform unauthorized actions.


The Clone plugin for WordPress contains a vulnerability in versions up to and including 2.4.3 that permits unauthorized actions due to missing authorization checks. This vulnerability has been addressed in version 2.4.4.

Detailed Overview:

The vulnerability in the Clone plugin highlights a significant security oversight in the Inisev Analyst Module, where specific functions lacked proper capability checks. This flaw could allow users with basic access levels, such as subscribers, to perform actions typically reserved for higher-level users, potentially leading to unauthorized data access or manipulation. The patched version 2.4.4 resolves these authorization issues, enhancing security measures to prevent such exploits.

Advice for Users:

  • Immediate Action: Users should update to the patched version, 2.4.4, immediately to secure their installations against this vulnerability.
  • Check for Signs of Vulnerability: Administrators are advised to review user activity logs for any unexpected or unauthorized actions that might have exploited this vulnerability.
  • Alternate Plugins: While the current version is secure, users concerned about past vulnerabilities may consider exploring alternative backup or cloning plugins that maintain a strong record of security.
  • Stay Updated: Keeping software updated to the latest versions is crucial in protecting against vulnerabilities and ensuring the highest security and functionality of your WordPress site.


The prompt resolution of the missing authorization vulnerability in the Clone plugin underscores the importance of regular software updates and vigilant security practices. By updating to version 2.4.4, users can safeguard their WordPress installations from potential unauthorized access and maintain the integrity of their sites. This incident serves as a reminder of the constant need to monitor and update software components to defend against evolving security threats.


Detailed Report: 

In the digital age, the security of your website extends far beyond just protecting your content—it safeguards your reputation, your data, and the trust your users place in you. The recent discovery of a significant vulnerability in the "Clone" plugin, a tool used by over 80,000 WordPress sites, serves as a critical reminder of the stakes involved. Named CVE-2024-31435, this vulnerability exposes sites to potential unauthorized actions due to missing authorization checks, emphasizing the ever-present need for vigilance in software management.

About the Plugin: Clone

The Clone plugin, developed by migrate, is popular among WordPress users for its ability to duplicate sites for migration or backup purposes. It boasts over 3 million downloads and supports 80,000 active installs. Despite its widespread use and utility, the plugin was recently found to be running versions susceptible to a security loophole, specifically in versions up to and including 2.4.3.

Vulnerability Details

CVE-2024-31435 affects the Clone plugin due to missing authorization checks within the Inisev Analyst Module, particularly in the element_pack_ajax_search function. This flaw allows authenticated users with even the lowest level of access to perform tasks typically reserved for administrators. The vulnerability, with a CVSS score of 4.3, was identified by researcher Dhabaleshwar Das and published on April 10, 2024.

Risks and Potential Impacts

This security gap could allow users with minimal permissions, such as subscribers, to execute actions that should be restricted to higher-level administrators, posing a serious risk of data breaches or unauthorized site changes. Such vulnerabilities could lead to significant disruptions, including the loss of sensitive data or even full control over the website, which could be disastrous for businesses relying on their digital presence.

Remediation Steps

Upon recognizing the vulnerability, the developers promptly released an updated version, 2.4.4, which addresses and patches the missing authorization checks. Website owners are urged to update their installations immediately to this new version to secure their sites effectively. It's also advisable for administrators to monitor activity logs for any unusual actions that might indicate exploitation of this vulnerability.

Overview of Previous Vulnerabilities

The Clone plugin has experienced five documented vulnerabilities since March 8, 2023. Each has been resolved with updates, demonstrating the developers' commitment to security and the plugin’s integrity.


The swift response to patch the CVE-2024-31435 vulnerability in the Clone plugin underscores the crucial importance of keeping software up-to-date. For small business owners who manage their WordPress sites, this incident highlights the necessity of regular maintenance and vigilance. Updating plugins not only resolves known vulnerabilities but also ensures that the website operates smoothly and securely, protecting both business operations and customer data. In an era where digital threats are constantly evolving, maintaining security isn't just a practice—it's a mandatory aspect of digital stewardship.

This comprehensive article aims to educate WordPress users, particularly small business owners, on the importance of vigilance in cybersecurity practices, through a detailed examination of the recent vulnerability within the "Clone" plugin.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Clone Vulnerability – Missing Authorization – CVE-2024-31435 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment