The Duplicate Page and Post WordPress plugin is vulnerable to Blind SQL Injection, which could allow an authenticated attacker to extract sensitive information from the underlying database.

This vulnerability is a Blind SQL Injection (CWE-89) arising from improper neutralization of special elements in SQL commands. The attack vector requires low-privileged authenticated access, allowing an attacker to manipulate queries via the affected plugin functions.

Successful exploitation allows an attacker to perform unauthorized database operations, potentially resulting in the exfiltration of sensitive site data, user information, or configuration details. While the CVSS score of 8.5 denotes a High severity, the impact is significant due to the potential for complete data exposure.

Immediate Action: As no official patch is currently available, administrators should immediately deactivate the plugin until a secure version is released by the vendor.

Proactive Monitoring: Monitor database query logs for anomalous patterns, specifically unusual SELECT or UNION statements originating from plugin-related functions.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust SQL injection filtering rules to intercept and block malicious payloads targeting the plugin.

Public Exploit Available: No

Given the severity of SQL injection vulnerabilities, immediate risk mitigation is required. Deactivate the plugin immediately and monitor the vendor’s advisory page for the release of a patched version. Do not re-enable the plugin until it has been updated to a version beyond 2.9.5.