The Duplica WordPress plugin suffers from a missing capability check (CWE-862) in its duplicate_user and duplicate_post functions in all versions up to 0.6. This flaw permits authenticated users with low privileges (Subscriber and above) to duplicate users and posts/pages, effectively enabling unauthorized data modification. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity with low attack complexity and no user interaction required. There is no indication of an official fix or patch available at this time.

An attacker with authenticated Subscriber-level access or higher can exploit this vulnerability to create duplicate users and duplicate posts/pages without proper authorization. This unauthorized modification could lead to data integrity issues or confusion in site content management. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting Subscriber-level user capabilities or disabling the Duplica plugin if duplication functionality is not essential. Monitor for updates from the plugin vendor or WordPress security sources for an official patch.