CVE-2025-12481

The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings that control role capabilities, and subsequently exploit the misconfigured capabilities to duplicate and view password-protected posts containing sensitive information.

• CWE-862

• https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.6/includes/Classes/ButtonDuplicate.php#L137
• https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.6/includes/Page/Settings.php#L92
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394773%40wp-duplicate-page%2Ftrunk&old=3386144%40wp-duplicate-page%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/61105f6a-1bd7-415d-9481-a1c2c310f778?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12475The Blocksy Companion plugin for WordPress is vulnerable to …6.4
• CVE-2025-12476Resource Lacking AuthN.This issue affects BLU-IC2: through 1…9.8
• CVE-2025-12477Server Version Disclosure.This issue affects BLU-IC2: throug…9.8
• CVE-2025-12478Non-Compliant TLS Configuration.This issue affects BLU-IC2: …9.8
• CVE-2025-12479Systemic Lack of Cross-Site Request Forgery (CSRF) Token Imp…8.8
• CVE-2025-12480Triofox versions prior to 16.7.10368.56560, are vulnerable t…9.1
• CVE-2025-12482The Booking for Appointments and Events Calendar – Amelia pl…7.5
• CVE-2025-12483The Visualizer: Tables and Charts Manager for WordPress plug…6.5
• CVE-2025-12484The Giveaways and Contests by RafflePress – Get More Website…7.2
• CVE-2025-12485Improper privilege management during pre-MFA cookie handling…8.8
• CVE-2025-12486Heimdall Data Database Proxy Cross-Site Scripting Remote Cod…8.8
• CVE-2025-12487oobabooga text-generation-webui trust_remote_code Reliance o…9.8