CVE-2021-43408: 
WordPress vulnerability analysis and mitigation

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. The vulnerability was discovered on October 19, 2021, and affects the plugin which had been downloaded 155,421 times at the time of discovery. This vulnerability can be exploited by any authenticated user who has been granted access to use the Duplicate Post plugin, which by default is limited to Administrators, but can be extended to Editor, Author, Contributor and Subscriber roles (AppCheck Advisory).

The vulnerability occurs in the posthander.php file within the cdpinsertpost function where the $id parameter is included within an SQL statement without proper sanitization. While the input is processed through the cdpsanitizearray function which applies sanitizetextfield recursively, the vulnerability exists because the tainted value is placed in the SQL statement where an integer is expected, rather than within a quoted string. The vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

SQL Injection can typically be exploited to read, modify and delete SQL table data. In many cases, it is also possible to exploit features of the SQL server to execute system commands and/or access the local file system (AppCheck Advisory).

The vendor has released an updated version (1.2.0) to remediate the flaw. Users should update to this version or newer to protect against this vulnerability. The update can be downloaded from the WordPress plugin repository (AppCheck Advisory).

The vendor's response to the vulnerability was notably quick, with the update being released within an hour of the initial report on October 19, 2021 (AppCheck Advisory).