CVE-2026-16539

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

View on CVE.org
Published Aug 3, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.

Analysis

AI-generated

Technical impact

The SM Page Duplicator WordPress plugin fails to sanitize a stored value before incorporating it into a SQL query used during page duplication. This flaw permits users with the Editor role or higher to inject arbitrary SQL code, potentially allowing them to read, modify, or delete database records. The vulnerability directly compromises database confidentiality and integrity and can be leveraged to tamper with site content or extract sensitive information.

Affected Systems

Any WordPress installation that uses the SM Page Duplicator plugin version 1.0.0 or earlier.

Risk and Exploitability

The risk is heightened for sites where Editor privileges are granted to many users; the vulnerability requires authenticated access but not elevated privileges beyond the role. Because the plugin does not sanitize inputs, the attack is straightforward for a legitimate Editor to perform. The CVSS score of 8.1 indicates high severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the potential for data loss remains significant due to the direct database access offered by the injection.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the SM Page Duplicator plugin to a version that corrects the SQL injection flaw (if a newer release exists in the official WordPress repository).
  • If an update is not available, deactivate or remove the plugin to eliminate the vulnerable code path from the site.
  • Limit the Editor role to trusted administrators only or revoke the capability for page duplication until a secure version is installed; alternatively employ a web application firewall to filter out SQL injection patterns targeting the duplication endpoint.

Generated by OpenCVE AI on August 4, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-20
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Shail Mehta
Shail Mehta sm Page Duplicator
Wordpress
Wordpress wordpress
Vendors & Products Shail Mehta
Shail Mehta sm Page Duplicator
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Weaknesses CWE-20
CWE-89
Type Values Removed Values Added
Description The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.
Title SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication
References
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Aug 3, 2026, 5:05 PM
Reserved
Jul 22, 2026, 9:38 AM

View source JSON

Updated
Aug 3, 2026, 5:05 PM

JSON

Status
Deferred
Published
Aug 3, 2026, 7:16 AM
Modified
Aug 26, 2026, 4:31 PM

View source JSON

No data.

Updated
Aug 4, 2026, 10:30 PM

JSON