CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Duplicate Page and Post allows Blind SQL Injection. This issue affects Duplicate Page and Post: from n/a through 2.9.5.
Explanation of Vulnerability in Simple Terms
The Duplicate Page and Post plugin for WordPress contains a SQL injection vulnerability in versions up to 2.9.5. An attacker with low-level user access can craft malicious input to execute arbitrary SQL queries against the site database. This can expose sensitive data including user credentials and site configuration. The vulnerability affects the scope beyond the plugin itself.
What an attacker can do
Read or modify database contents, including user passwords and site configuration data.
Potential impact on your site
User passwords, email addresses, and other sensitive database records could be exposed or altered by an authenticated attacker.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (subscriber or contributor level or higher).
Key dates
External resources
Related vulnerabilities
