The WP Duplicate Page plugin contains a missing authorization flaw in its saveSettings function that allows any authenticated user with a Contributor role or higher to modify the plugin’s settings, specifically the role capabilities. By changing these settings, an attacker can grant themselves or other users permission to duplicate and read password‑protected posts that should be confidential. The vulnerability therefore enables a confidentiality breach by exposing sensitive content to users who should not have access to it.

The vulnerability affects the WP Duplicate Page plugin, version 1.7 and earlier, distributed by ninjateam. Only installations running these versions are impacted; newer releases are presumed to have the issue resolved.

The CVSS score of 4.3 reflects a moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is currently not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with at least Contributor privileges, so the attack vector is indirect but readily achievable for anyone who can log in to the WordPress site. If a site grants Contributor access to a broad user base, the risk of accidental or malicious disclosure increases.