WP Duplicate Page Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the WP Duplicate Page plugin for WordPress, in all versions through 1.8, allowing unauthorized data modification. The issue arises from inadequate capability checks in the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions. This flaw enables authenticated attackers with Contributor-level access and above to duplicate any posts, pages, or WooCommerce HPOS orders, regardless of their role's exclusion from the plugin's 'Allowed User Roles' setting. Such exploitation could reveal sensitive information and result in the unauthorized fulfillment of WooCommerce orders.

Impact

Exploitation of this vulnerability could lead to unauthorized duplication of posts, pages, and WooCommerce HPOS orders, potentially exposing sensitive information and allowing for duplicate fulfillment of WooCommerce orders.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can initiate a bulk action to duplicate posts or pages. The vulnerability can also be reproduced by duplicating WooCommerce HPOS orders, taking advantage of the same missing authorization checks.

Remediation

Users are advised to update the WP Duplicate Page plugin to version 1.8.1 or a newer patched version.