CVE-2025-12481

Name of the Vulnerable Software and Affected Versions WP Duplicate Page plugin versions prior to 1.8

Description The WP Duplicate Page plugin for WordPress is affected by a missing authorization issue. The plugin does not properly verify user authorization to perform actions within the saveSettings() function. This allows authenticated attackers with Contributor-level access or higher to modify plugin settings related to role capabilities. Exploiting these misconfigured capabilities can lead to the duplication and viewing of password-protected posts containing sensitive information.

Recommendations Update the WP Duplicate Page plugin to version 1.8 or later.