CVE-2024-12538 is a sensitive information exposure vulnerability (CWE-200) in the Duplicate Post, Page and Any Custom Post WordPress plugin by binsaifullah. The flaw exists in the 'dpp_duplicate_as_draft' function and affects all versions up to and including 3.5.5. Authenticated attackers with Contributor-level permissions or higher can exploit this to extract sensitive data from posts that are drafts, scheduled for future publication, private, or password protected. The vulnerability does not affect availability or integrity, only confidentiality, and has a CVSS 3.1 base score of 4.3 (medium). There is no indication of known exploits in the wild or vendor-provided patches at this time.

An attacker with Contributor-level or higher access can read sensitive content from posts that are not publicly accessible, including drafts, scheduled posts, private posts, and password-protected posts. This exposure compromises confidentiality of potentially sensitive information stored in these posts. There is no impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for updates from the plugin vendor or WordPress security advisories. Avoid granting Contributor or higher privileges to untrusted users to limit exposure.