The WP Duplicate WordPress plugin up to version 1.1.11 does not properly verify authentication values and fails to validate the upload path or file type. Accordingly, an unauthenticated attacker can send a crafted request that bypasses authentication, upload an arbitrary file, and potentially execute code on the server.

The affected product is the WP Duplicate WordPress plugin. Versions 1.1.11 and earlier are vulnerable. The vendor is listed as Unknown:WP Duplicate. No other components are mentioned as affected.

The CVSS score for this vulnerability is not provided, and no EPSS value is available; however, the description indicates active exploitation in the wild. The lack of authentication checks and file type restrictions means the attack can be launched from any unauthenticated session that can reach the upload endpoint, giving the attacker the privileges of the web server process and resulting in remote code execution. Although KEV status is not listed, the confirmed exploitation underscores a high risk.