Analysis Report Folder Analysis cache/wp-duplicate-page_1.8 → cache/wp-duplicate-page_1.8.1 - CVE-2025-14001

```
Vulnerability Existed: yes
TRUE POSITIVE
Improper Access Control - CWE-284 - includes/Classes/ButtonDuplicate.php [56-58, 84-86]

Old Code:
public function duplicateBulkHandle( $redirect, $action, $postIds ) {
    if ( 'wp_duplicate_page_bulk_action' === $action ) {
        // Get the original post
        $counter = 0;
        if ( is_array( $postIds ) ) {
            ...

Fixed Code:
public function duplicateBulkHandle( $redirect, $action, $postIds ) {
    if ( 'wp_duplicate_page_bulk_action' === $action ) {
        if ( ! Utils::isCurrentUserAllowedToCopy() ) {
            return $redirect;
        }
        // Get the original post
        $counter = 0;
        if ( is_array( $postIds ) ) {
            ...

Explanation:
The original code was missing authorization checks before performing bulk page duplication operations. An authenticated user could potentially duplicate pages without proper permission validation. The fix adds a capability check via `Utils::isCurrentUserAllowedToCopy()` in both bulk action handlers (`duplicateBulkHandle` and `duplicateBulkHandleHPOS`), ensuring only authorized users can execute the duplication action. This prevents privilege escalation and unauthorized content duplication.
```

Analyzing the provided code diff for security vulnerabilities...

Vulnerability Existed: no
No CWE - N/A - wp-duplicate-page.php (all lines)

Old Code:
Plugin URI: https://ninjateam.org/wp-duplicate-page/
Version: 1.8
define( 'NJT_DUPLICATE_VERSION', '1.8' );

Fixed Code:
Plugin URI: https://ninjateam.org
Version: 1.8.1
define( 'NJT_DUPLICATE_VERSION', '1.8.1' );

Explanation:
This diff contains only metadata and version number updates. The changes include:
1. Plugin URI simplified from full path to root domain
2. Version bumped from 1.8 to 1.8.1
3. Version constant updated to match

These are routine maintenance updates with no security implications. No code logic changes, no input handling modifications, no authentication/authorization changes, and no introduction or removal of security-related functionality. This appears to be a minor version bump with no security fixes or vulnerabilities present.