This vulnerability (CVE-2026-49046) in the Arjun Thakur Duplicate Page and Post plugin is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It allows blind SQL injection attacks, which can be exploited remotely over the network by an attacker with low privileges and no user interaction required. The CVSS 3.1 base score is 8.5, reflecting high confidentiality impact, no integrity impact, and low availability impact. The affected versions include all versions up to 2.9.5. No patch or official remediation level has been published yet.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited denial of service (low availability impact). Since the attack vector is network-based and requires low privileges, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin functionality to trusted users only and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted networks.