The vulnerability is a Missing Authorization flaw in the revmakx WP Duplicate local‑sync plugin, allowing an attacker to execute plugin functions without proper privileges. This breach enables unauthorized use of plugin features, potentially exposing sensitive data or facilitating further attacks. The weakness is classified as CWE‑862, a Broken Access Control.

The affected product is the WP Duplicate plugin by revmakx, versions from the earliest available configuration through version 1.1.6.

The CVSS score of 5.4 indicates moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, and no current public exploits are documented. Likely attack vectors include automated web requests targeting the plugin’s interface or endpoints, exploiting the incorrect access control levels to gain unauthorized functionality. The impact is confined to the WordPress site where the plugin is installed and could affect confidentiality and integrity of content managed through the plugin.