CVE-2023-52145 is a medium severity (4.3 CVSS) cross-site request forgery flaw in the Republish Old Posts plugin for WordPress, in versions through 1.21. Patchstack lists 1.27 as the patched release, so update to 1.27 or later. Exploitation needs a signed-in privileged user to be tricked into sending a request.
What's affected
The NVD record covers Republish Old Posts from Marios Alexandrou, a plugin that republishes older posts, in all versions through 1.21. Patchstack agrees on the vulnerable range and names 1.27 as the patched version.
The record classifies the weakness as CWE-352 (Cross-Site Request Forgery). The CVSS vector in the record is network based with no privileges required but with user interaction required, and it scores low confidentiality, high integrity impact. The advisory does not say which plugin action lacks the check, so assume any admin screen of the plugin could be involved until you have updated.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get republish-old-posts --field=version
The slug republish-old-posts comes from the Patchstack advisory address. Confirm it matches the folder name under wp-content/plugins on your site. If the version is 1.21 or lower, the site is in the affected range. You can also read the version on the Plugins screen of the WordPress dashboard.
For agencies, run the same listing across every client site and collect the results in one sheet. Plugins that are installed but inactive still count as inventory.
What to do now
- Take a backup or snapshot before changing anything.
- Update Republish Old Posts to 1.27 or later, from the dashboard or with
wp plugin update republish-old-posts. - If the plugin is unused, deactivate and delete it instead of updating it.
- Review recent changes in the plugin settings and look for administrator accounts you do not recognise.
- Ask administrators to use a separate browser profile for admin work and to sign out when finished, which shrinks the window a forged request needs.
Why it matters
The weakness here is a missing proof of intent. WordPress offers nonces for this job, which are short-lived tokens tied to a user and an action. When a plugin handler skips that check, any page that can make the browser send a request to the site can ride on the admin's session.
Patchstack labels the entry low priority with a CVSS score of 4.3. The vector marks user interaction as required, which is why the number stays moderate. That does not make it safe to ignore on sites where several people hold administrator accounts. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
Quick check
What if I no longer use the plugin?
Deactivate and delete it. Inactive plugins still sit on disk, and their files can remain reachable on some setups, so removal is safer than leaving them deactivated.
Do I need to be logged in as an admin for this to matter?
The attack works through a logged-in privileged user whose browser is tricked into sending a request. The attacker does not need an account of their own. A site with no signed-in privileged users at the moment is a harder target, but that is not a fix.
Sources
Last reviewed: 19 October 2026.
