The WP Bulk Post Duplicator plugin for WordPress, developed by Rajesh Kumar, contains a CSRF vulnerability identified as CVE-2025-28884. This vulnerability affects all versions up to 1.2 and allows an attacker to induce an authenticated user to execute unwanted actions by submitting forged requests. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on integrity without affecting confidentiality or availability. No vendor advisory or patch information is currently provided.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause an authenticated user to perform unintended actions within the WP Bulk Post Duplicator plugin, potentially leading to limited integrity impact. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the WP Bulk Post Duplicator plugin or implementing CSRF protections such as verifying nonce tokens in requests if possible. Monitor official channels for updates from the vendor.