All versions of the Improved Save Button plugin up to 1.2.1 for WordPress contain a second‑order SQL injection flaw in the meta_key parameter used by the "Save and Duplicate" action. An authenticated user with author‑level access or higher can craft input that is later incorporated into an existing SQL query, thereby appending arbitrary SQL statements. This capability enables the attacker to read or modify sensitive database content, potentially exposing confidential information or altering system integrity.

WordPress sites that have installed the Improved Save Button plugin version 1.2.1 or earlier and have enabled the duplicate feature for any user with author or higher privileges.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1 %, pointing to a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack requires authenticated access to the WordPress backend and the use of the duplicate action, which may not be exposed to casual users but is available to all authors and above.