PT-2026-2355 · WordPress+1 · Wp Duplicate Page+1

Sarawut Poolkhet · Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-14001

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Duplicate Page plugin for WordPress versions prior to 1.9

Description The WP Duplicate Page plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to missing capability checks within the duplicateBulkHandle and duplicateBulkHandleHPOS functions. Authenticated attackers with Contributor-level access or higher can duplicate posts, pages, and WooCommerce HPOS orders, even if their user role is not permitted in the plugin’s settings. This could lead to the exposure of sensitive information and the potential for duplicate fulfillment of WooCommerce orders.

Recommendations Update the WP Duplicate Page plugin to version 1.9 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14001

Affected Products

Wp Duplicate Page

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14001 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L54 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/60830ed8-3ab8-44e8-899c-7032a187da8b?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3432233 · Note
• https://twitter.com/CVEnew/status/2011039625775612282 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011062846042284422 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L79 · Note