The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts and pages.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Duplicate_post_page_menu_&_custom_post_type | Inqsys | * | 2.3.1 (including) |