SQL Injection Vulnerability in Duplicate Page and Post Plugin for WordPress

CVE-2025-6189

What is CVE-2025-6189?

The Duplicate Page and Post plugin for WordPress is susceptible to a time-based SQL injection vulnerability. This issue arises from inadequate escaping of the user-supplied 'meta_key' parameter combined with insufficient preparation in the SQL queries. Attackers with Contributor-level access or higher can exploit this vulnerability to append malicious SQL queries, potentially extracting sensitive database information.

References