Description
The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.
Published: 2026-08-03
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The SM Page Duplicator WordPress plugin fails to sanitize a stored value before incorporating it into a SQL query used during page duplication. This flaw permits users with the Editor role or higher to inject arbitrary SQL code, potentially allowing them to read, modify, or delete database records. The vulnerability directly compromises database confidentiality and integrity and can be leveraged to tamper with site content or extract sensitive information.

Affected Systems

Any WordPress installation that uses the SM Page Duplicator plugin version 1.0.0 or earlier.

Risk and Exploitability

The risk is heightened for sites where Editor privileges are granted to many users; the vulnerability requires authenticated access but not elevated privileges beyond the role. Because the plugin does not sanitize inputs, the attack is straightforward for a legitimate Editor to perform. The CVSS score of 8.1 indicates high severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the potential for data loss remains significant due to the direct database access offered by the injection.

Generated by OpenCVE AI on August 4, 2026 at 22:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the SM Page Duplicator plugin to a version that corrects the SQL injection flaw (if a newer release exists in the official WordPress repository).
  • If an update is not available, deactivate or remove the plugin to eliminate the vulnerable code path from the site.
  • Limit the Editor role to trusted administrators only or revoke the capability for page duplication until a secure version is installed; alternatively employ a web application firewall to filter out SQL injection patterns targeting the duplication endpoint.

Generated by OpenCVE AI on August 4, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Mon, 03 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Shail Mehta
Shail Mehta sm Page Duplicator
Wordpress
Wordpress wordpress
Vendors & Products Shail Mehta
Shail Mehta sm Page Duplicator
Wordpress
Wordpress wordpress

Mon, 03 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-89

Mon, 03 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.
Title SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication
References

Subscriptions

Shail Mehta Sm Page Duplicator
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-03T17:05:55.575Z

Reserved: 2026-07-22T09:38:32.742Z

Link: CVE-2026-16539

cve-icon Vulnrichment

Updated: 2026-08-03T17:05:51.166Z

cve-icon NVD

Status : Received

Published: 2026-08-03T07:16:41.770

Modified: 2026-08-03T18:16:37.740

Link: CVE-2026-16539

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T22:30:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')