< 2.6
2.6
The duplicate-post plugin before 2.6 for WordPress has SQL injection.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.