The Arjun Thakur Duplicate Page and Post plugin contains a critical Blind SQL Injection vulnerability that could allow unauthorized database access.

This is a Blind SQL Injection vulnerability where the application fails to properly sanitize special characters in user-supplied input. While the authentication level is not explicitly stated, SQL injection flaws in WordPress plugins often allow unauthenticated or low-privileged attackers to extract sensitive database content.

Successful exploitation allows an attacker to perform unauthorized database queries, potentially leading to the theft of sensitive site data, user credentials, or administrative configuration details. With a CVSS score of 8.5, this vulnerability represents a high risk to the confidentiality and integrity of the hosting environment.

Immediate Action: Check the official WordPress plugin repository or the developer's site for an updated version and apply it immediately.

Proactive Monitoring: Enable database query logging to identify unusual patterns, such as unexpected syntax or large volumes of error-inducing queries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled to block malicious payloads targeting the plugin.

Public Exploit Available: false

Given the high severity of this SQL injection vulnerability, organizations using the Duplicate Page and Post plugin should prioritize updates. If a patch is unavailable, consider disabling the plugin until a secure version is released to prevent potential data exfiltration.