Missing Authorization Vulnerability in WP Duplicate Page Plugin for WordPress

CVE-2025-12481

What is CVE-2025-12481?

The WP Duplicate Page plugin for WordPress is susceptible to a Missing Authorization flaw in all versions up to and including 1.7. This vulnerability arises from inadequate checks within the 'saveSettings' function, failing to confirm that an authorized user is executing the action. As a result, attackers with Contributor-level access and higher can alter plugin settings that dictate role capabilities. This misconfiguration could allow them to duplicate posts and access password-protected content containing sensitive information, presenting a significant security risk to affected WordPress sites.

References