The WP Duplicate Page plugin, versions up to and including 1.8, contains missing capability checks in its bulk duplication handlers. An attacker with any authenticated WordPress role of Contributor or higher can invoke these handlers to duplicate posts, pages, or WooCommerce HPOS orders. The result is the creation of duplicate content or orders without authorization, potentially exposing sensitive data and enabling duplicate order fulfillment.

Any WordPress site that has installed the ninjateam WP Duplicate Page plugin version 1.8 or earlier is affected. The vulnerability applies to all instances of the plugin regardless of the ‘Allowed User Roles’ setting, because the check is omitted from the underlying functions. Any site owner using the plugin in these versions should verify the current plugin version and consider immediate update or removal.

The CVSS score of 5.4 places this issue in the moderate severity range. The EPSS score of less than 1% indicates a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is straightforward: an authenticated user can simply press the duplicate button, bypassing role limits. The missing capability check removes the intended authorization boundary, so exploitation does not require additional privileges, misconfiguration, or network access. The risk remains primarily to data integrity and confidentiality, especially for WooCommerce orders that could be duplicated for illicit fulfillment.