The Duplicate Page and Post WordPress plugin suffers from a time‑based SQL injection flaw in the meta_key parameter in all releases up to 2.9.5. The thin or missing escaping of user supplied data, combined with a lack of query preparation, permits an attacker with Contributor or greater privileges to inject additional SQL statements. Exploitation can result in the read‑out of sensitive database content, representing a confidentiality breach. The weakness is identified as a classic SQL injection (CWE‑89).

The issue affects the WordPress plugin named Duplicate Page and Post, developed by arjunthakur. All versions whose release number is 2.9.5 or earlier are vulnerable; any instance running one of those versions is at risk.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently very low. The vulnerability is confined to authenticated users with Contributor level or higher, and the plugin must be active for exploitation. It is not listed in CISA’s KEV catalog.