CVE-2025-14001 WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
Authenticated contributors can bypass role restrictions to duplicate arbitrary posts and orders, potentially exposing sensitive data or causing duplicate fulfillments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14001?
CVE-2025-14001 is a medium-severity missing authorization vulnerability in ninjateam WP Duplicate Page, published on 13 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's "Allowed User Roles" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders.
Weakness: CWE-862
Which versions are affected by CVE-2025-14001?
How do I fix CVE-2025-14001?
No fix has been published for CVE-2025-14001 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-14001 being exploited?
There is no known exploitation of CVE-2025-14001 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-crjh-4642-9w67.