CVE-2026-16092: WordPress Improved Save Button SQL Injection

CVE-2026-16092 Overview

CVE-2026-16092 is a second-order SQL injection vulnerability in the Improved Save Button plugin for WordPress. The flaw affects all versions up to and including 1.2.1. Attackers with author-level access or above can inject SQL through the meta_key custom field when triggering the plugin's Save and Duplicate action. The vulnerability stems from insufficient escaping of user-supplied input and lack of proper query preparation. Successful exploitation enables extraction of sensitive information from the WordPress database.

Critical Impact
Authenticated attackers holding author-level accounts can exfiltrate database contents, including user credentials, secrets stored in wp_options, and private post data, through injected UNION-style SQL payloads.

Affected Products

Improved Save Button plugin for WordPress
All versions up to and including 1.2.1
WordPress sites permitting author-level or higher account creation

Discovery Timeline

2026-07-30 - CVE-2026-16092 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16092

Vulnerability Analysis

The plugin exposes a Save and Duplicate action that copies post metadata when creating a duplicate post. The action processes the meta_key value stored against a post and later concatenates it into a SQL statement executed against the WordPress database. Because the plugin neither escapes the value with esc_sql() nor uses parameterized queries through $wpdb->prepare(), an attacker can persist a malicious meta_key value during one request and detonate it during a subsequent duplication request. This is the defining pattern of second-order SQL injection [CWE-89]: the payload is stored in a trusted context and triggered later when the tainted value flows into a dynamic query.

Root Cause

The root cause resides in the duplication logic in class-lb-save-and-then-action-duplicate.php and the post save handler in class-lb-save-and-then-post-save.php. The meta_key parameter is retrieved from the database and inserted directly into the SQL string without preparation. WordPress database APIs provide prepare() for placeholder-based queries, but the plugin bypasses this safeguard.

Attack Vector

An authenticated attacker with author permissions first stores a crafted meta_key value on a post they own. The value contains SQL syntax designed to break out of the intended query context. When the attacker invokes the Save and Duplicate action, the stored payload is read back and appended to the query executed by the plugin. The concatenated statement enables UNION SELECT operations that return data from arbitrary tables. Impact is limited to confidentiality; the CVSS vector indicates no integrity or availability effect.

No verified public exploit code is available. Refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Report for source-level analysis.

Detection Methods for CVE-2026-16092

Indicators of Compromise

Unexpected postmeta rows containing SQL keywords such as UNION, SELECT, FROM, or INFORMATION_SCHEMA in the meta_key column
Author-level accounts invoking the Save and Duplicate action against posts with unusual metadata
MySQL general or slow query log entries showing malformed queries originating from the improved-save-button code path
Sudden spikes in wp_users or wp_options read activity following a duplication event

Detection Strategies

Audit wp_postmeta for meta_key values that contain non-alphanumeric SQL metacharacters such as backticks, single quotes, or comment markers
Enable WordPress query logging via SAVEQUERIES in staging to identify unparameterized statements produced by the plugin
Correlate web access logs for POST requests to admin.php or post.php combined with the save_and_then action parameter

Monitoring Recommendations

Alert on new author-level or contributor account creation followed by post duplication activity within a short window
Monitor database error logs for syntax errors that indicate probing of the injection point
Track outbound data volumes from the WordPress host to identify possible exfiltration of query results

How to Mitigate CVE-2026-16092

Immediate Actions Required

Deactivate and remove the Improved Save Button plugin until a patched release is confirmed installed
Rotate WordPress secret keys in wp-config.php and force password resets for administrator accounts
Review author-level and higher accounts and remove any that are unrecognized or dormant
Restrict access to the WordPress admin interface using IP allowlisting or reverse-proxy authentication

Patch Information

At the time of publication, all versions of the Improved Save Button plugin up to and including 1.2.1 are affected. Consult the Wordfence Vulnerability Report for the latest fixed-version status and update the plugin to any release above 1.2.1 once available.

Workarounds

Remove or disable the plugin entirely until an updated version is published
Restrict the author role to trusted users only and audit existing role assignments
Deploy a web application firewall (WAF) rule that blocks SQL metacharacters in meta_key request parameters targeting the Save and Duplicate endpoint
Enforce least-privilege database credentials for the WordPress MySQL user to limit cross-table SELECT capability

bash

# Configuration example: disable the plugin via WP-CLI while triaging
wp plugin deactivate improved-save-button
wp plugin delete improved-save-button

# Audit postmeta for suspicious meta_key values
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_key REGEXP '[\'\"();]|UNION|SELECT|--';"