CVE-2025-14001

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14001", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T00:59:24.837Z", "datePublished": "2026-01-13T11:21:19.781Z", "dateUpdated": "2026-04-08T16:56:38.069Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:38.069Z"}, "affected": [{"vendor": "ninjateam", "product": "WP Duplicate Page", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's \"Allowed User Roles\" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders."}], "title": "WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60830ed8-3ab8-44e8-899c-7032a187da8b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L79"}, {"url": "https://plugins.trac.wordpress.org/changeset/3432233/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sarawut Poolkhet"}], "timeline": [{"time": "2025-12-04T01:16:24.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T16:55:38.563897Z", "id": "CVE-2025-14001", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T17:18:48.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T16:55:38.563897Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T17:18:33.007Z"}}], "cna": {"title": "WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication", "credits": [{"lang": "en", "type": "finder", "value": "Sarawut Poolkhet"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "ninjateam", "product": "WP Duplicate Page", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T01:16:24.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-12T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60830ed8-3ab8-44e8-899c-7032a187da8b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L79"}, {"url": "https://plugins.trac.wordpress.org/changeset/3432233/"}], "descriptions": [{"lang": "en", "value": "The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's \"Allowed User Roles\" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-13T11:21:19.781Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14001", "state": "PUBLISHED", "dateUpdated": "2026-01-13T17:18:48.237Z", "dateReserved": "2025-12-04T00:59:24.837Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-13T11:21:19.781Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Duplicate Page", "vendor": "ninjateam", "versions": [{"lessThanOrEqual": "1.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's \"Allowed User Roles\" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders."}, {"lang": "es", "value": "El plugin WP Duplicate Page para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de comprobaciones de capacidad en las funciones 'duplicateBulkHandle' y 'duplicateBulkHandleHPOS' en todas las versiones hasta la 1.8, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, dupliquen publicaciones, p\u00e1ginas y pedidos HPOS de WooCommerce arbitrarios incluso cuando su rol est\u00e1 expl\u00edcitamente excluido de la configuraci\u00f3n 'Roles de usuario permitidos' del plugin, exponiendo potencialmente informaci\u00f3n sensible y permitiendo el cumplimiento duplicado de pedidos de WooCommerce."}], "id": "CVE-2025-14001", "lastModified": "2026-06-17T08:35:08.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14001", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T16:55:38.563897Z", "version": "2.0.3"}}]}, "published": "2026-01-13T12:15:48.630", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L54"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.8/includes/Classes/ButtonDuplicate.php#L79"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3432233/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60830ed8-3ab8-44e8-899c-7032a187da8b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:27:53.362283+00:00", "value": {"mitigation_remediation": ["Update WP Duplicate Page to the latest version (at least 1.9) where capability checks are enforced", "If an update is not immediately possible, delete the plugin or disable it for all sites to prevent accidental duplication", "Configure a role\u2011based restriction that removes Contributor or higher roles from accessing the duplication functionality by disabling the relevant plugin settings or using a security plugin to block the duplicate endpoint"], "summary": {"action": "Apply Patch", "impact": "Unauthorized data duplication and sensitive information exposure"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has installed the ninjateam WP Duplicate Page plugin version 1.8 or earlier is affected. The vulnerability applies to all instances of the plugin regardless of the \u2018Allowed User Roles\u2019 setting, because the check is omitted from the underlying functions. Any site owner using the plugin in these versions should verify the current plugin version and consider immediate update or removal.", "description_and_impact": "The WP Duplicate Page plugin, versions up to and including 1.8, contains missing capability checks in its bulk duplication handlers. An attacker with any authenticated WordPress role of Contributor or higher can invoke these handlers to duplicate posts, pages, or WooCommerce HPOS orders. The result is the creation of duplicate content or orders without authorization, potentially exposing sensitive data and enabling duplicate order fulfillment.", "risk_and_exploitability": "The CVSS score of 5.4 places this issue in the moderate severity range. The EPSS score of less than 1% indicates a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is straightforward: an authenticated user can simply press the duplicate button, bypassing role limits. The missing capability check removes the intended authorization boundary, so exploitation does not require additional privileges, misconfiguration, or network access. The risk remains primarily to data integrity and confidentiality, especially for WooCommerce orders that could be duplicated for illicit fulfillment."}}}}, "created": "2026-01-14T11:09:28.115550+00:00", "updated": "2026-04-21T16:30:40.684981+00:00", "vendors": ["ninjateam", "ninjateam$PRODUCT$wp_duplicate_page", "wordpress", "wordpress$PRODUCT$wordpress"]}