WordPress WP Duplicate Plugin Remote Code Execution Vulnerability

The WP Duplicate WordPress plugin through version 1.1.11 contains a critical flaw that allows unauthenticated attackers to write arbitrary files to the server, leading to remote code execution.

The plugin fails to properly verify a request authentication value and does not validate the path or type of uploaded files.

• Affected versions: through 1.1.11
• Attack vector: unauthenticated
• Impact: arbitrary file write and remote code execution
• Status: actively exploited in the wild