WordPress Duplicate Post Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the WordPress Duplicate Post, Page and Any Custom Post plugin, affecting all versions through 3.5.5. The issue arises in the 'dpp_duplicate_as_draft' function, where authenticated attackers with Contributor-level access and above can access potentially sensitive data from draft, scheduled, private, and password-protected posts.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information from various types of posts, including drafts, scheduled posts, private posts, and those protected by a password.

Remediation

Users are advised to update the plugin to version 3.5.6 or a newer patched version.