The WP Duplicate Page plugin for WordPress contains a Missing Authorization vulnerability in all versions up to and including 1.7. This flaw allows authenticated users with Contributor-level access or higher to modify plugin settings improperly. Exploiting this weakness, attackers can alter role capabilities and subsequently duplicate and view password-protected posts that may contain sensitive information.