The vulnerability is an unescaped SQL injection that allows attackers with Contributor-level or higher access to a WordPress site to inject payloads into the 'meta_key' parameter used when cloning a post. The payload is stored as a post meta key and later executed during the cloning process, enabling the attacker to append arbitrary SQL statements to existing database queries. This second‑order injection can read, modify, or delete sensitive database information. The weakness corresponds to CWE‑89, reflecting improper input sanitization for database queries.

The Fast Page & Post Duplicator plugin for WordPress is affected in all releases up to and including version 6.3. Sites that run any of these versions and have role users with Contributor or higher privileges are vulnerable to exploitation.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attack requires an authenticated user with Contributor privileges or above; the attack vector is inferred from the description as it relies on the ability to perform a post clone operation and supply a crafted meta_key parameter. An attacker could use this to read confidential data or manipulate the database, with potential downstream effects on site integrity and confidentiality.