The WP Duplicate plugin contains a missing authorization check on the process_add_site AJAX action, coupled with path traversal in the file upload routine. An authenticated user with subscriber privileges can set an internal option, prod_key_random_id, which an unauthenticated attacker can later use to bypass permission checks and write arbitrary files through handle_upload_single_big_file(). This flaw can be leveraged to upload malicious code, resulting in remote code execution on the host system.

The vulnerability affects the WordPress plugin WP Duplicate, developed by revmakx, in all releases up to and including 1.1.8. No specific internal plugin revisions were listed, so any installation of the affected versions is considered exposed.

The CVSS base score is 8.8, classifying it as high severity. The EPSS value is less than 1%, suggesting a low probability of exploitation at the time of this analysis, and the flaw is not listed in the CISA KEV catalog. The attack requires an authenticated subscriber account, but once the internal option is set, an unauthenticated attacker can complete the file upload, making the attack path relatively straightforward for an insider or compromised user. Officials have not provided an official workaround, and no exploit code has been reported yet.