CVE-2025-14001: 
WordPress vulnerability analysis and mitigation

CVE-2025-14001 is a Missing Authorization vulnerability in the WP Duplicate Page plugin for WordPress, developed by NinjaTeam. The flaw allows authenticated attackers with Contributor-level access or above to duplicate arbitrary posts, pages, and WooCommerce HPOS orders, bypassing the plugin's "Allowed User Roles" access control setting. All versions up to and including 1.8 are affected. The CVE was published on January 13, 2026, with Wordfence as the assigning CNA. It carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the duplicateBulkHandle and duplicateBulkHandleHPOS functions in ButtonDuplicate.php (lines 54 and 79 of the 1.8 tag) do not perform capability checks before executing bulk duplication operations (Wordfence, WordPress Trac). An attacker with at least Contributor-level authentication can send crafted requests to invoke these functions, even if their role has been explicitly excluded in the plugin's settings. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit from any authenticated WordPress account.

Successful exploitation allows an authenticated attacker to duplicate any post, page, or WooCommerce HPOS order on the affected WordPress site, regardless of role restrictions configured by the administrator. This poses a confidentiality risk by potentially exposing draft or private content (e.g., unpublished posts or sensitive order data) through duplicated copies, and an integrity risk by enabling unauthorized data manipulation. In WooCommerce environments, duplicate fulfillment of orders could result in financial loss or inventory discrepancies (Wordfence).

1. Reconnaissance: Identify a WordPress site running WP Duplicate Page plugin version ≤ 1.8 by checking the plugin's readme or version file (e.g., /wp-content/plugins/wp-duplicate-page/readme.txt).
2. Obtain Contributor access: Register or log in as a user with at least Contributor-level privileges on the target WordPress site.
3. Identify target content: Browse the site or use the WordPress REST API to enumerate post IDs, page IDs, or WooCommerce order IDs of interest (including private or draft content).
4. Invoke vulnerable function: Send a crafted authenticated POST or AJAX request to the WordPress admin AJAX endpoint (/wp-admin/admin-ajax.php) invoking the duplicateBulkHandle or duplicateBulkHandleHPOS action with the target post/order IDs, bypassing the plugin's role restriction check.
5. Access duplicated content: Retrieve the newly created duplicate post, page, or order, which may expose sensitive information from private drafts or trigger duplicate WooCommerce order fulfillment (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to /wp-admin/admin-ajax.php with action=duplicateBulkHandle or action=duplicateBulkHandleHPOS from Contributor-level or other low-privilege accounts.
• File System / Database: Unexpected duplicate posts, pages, or WooCommerce orders appearing in the WordPress database (wp_posts table) with post_status of draft or publish, created by low-privilege user accounts.
• Logs: WordPress debug logs or query logs showing bulk duplication operations initiated by user roles that are explicitly excluded in the WP Duplicate Page plugin's "Allowed User Roles" setting.
• Network: Repeated AJAX requests to the WordPress admin endpoint from the same authenticated session targeting multiple post or order IDs in rapid succession.

Users should update the WP Duplicate Page plugin to version 1.9 or later, which includes the fix applied in changeset 3432233 that adds proper capability checks to the affected functions (WordPress Trac). As an interim workaround, site administrators can deactivate the plugin until the update is applied, or restrict Contributor-level registration if open registration is enabled. Reviewing and auditing existing duplicate posts or orders for unauthorized content is also recommended following remediation.

Sucuri included CVE-2025-14001 in their January 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). The vulnerability was also noted on security aggregation platforms including VulDB and Vulners shortly after disclosure, indicating routine community tracking without significant alarm given the medium severity rating.