Wp Duplicate Page
Approved changes feed: RSS · Atom
cpe:2.3:a:ninjateam:wp_duplicate_page:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Ninjateam (60f12742-896a-5f99-ac58-783aeff1a80d) |
|---|---|
| Product | Wp Duplicate Page (e79c676b-e280-5bf9-86af-1c98a45a6064) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-14001 |
vulnerable | 2026-06-03 14:58:54.288074 |
WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
MEDIUM (5.4)
The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's "Allowed User Roles" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders.
Published: 2026-01-13T11:21:19.781Z
Updated: 2026-04-08T16:56:38.069Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12481 |
vulnerable | 2026-06-03 14:58:44.429389 |
WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
MEDIUM (4.3)
The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings that control role capabilities, and subsequently exploit the misconfigured capabilities to duplicate and view password-protected posts containing sensitive information.
Published: 2025-11-18T09:27:38.298Z
Updated: 2026-04-08T16:56:44.550Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.