Wp Duplicate
Monthly
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.