CVE-2026-16539: SM Page Duplicator WordPress SQLi Flaw

CVE-2026-16539 Overview

CVE-2026-16539 is a stored SQL Injection vulnerability in the SM Page Duplicator WordPress plugin through version 1.0.0. The plugin fails to sanitise and escape a stored value before using it in a SQL statement during the page duplication workflow. Authenticated users with the Editor role or higher can inject arbitrary SQL through this code path. Successful exploitation allows attackers to read or modify sensitive data in the WordPress database. The issue is tracked under CWE-89 and carries a CVSS 3.1 score of 8.1.

Critical Impact
Editor-level accounts can execute arbitrary SQL against the WordPress database, exposing credentials, session tokens, and post content, and enabling tampering with site data.

Affected Products

SM Page Duplicator WordPress plugin, all versions through 1.0.0
WordPress installations where the plugin is active and Editor or higher accounts exist
Multisite deployments sharing the vulnerable plugin across subsites

Discovery Timeline

2026-08-03 - CVE-2026-16539 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16539

Vulnerability Analysis

The vulnerability resides in the page duplication logic of the SM Page Duplicator plugin. When a page is duplicated, the plugin reads a stored value and concatenates it into a SQL statement without sanitisation or escaping. An authenticated user with Editor privileges can influence the stored value that is later interpolated into the query. When the duplication routine executes, the attacker-controlled SQL runs with the privileges of the WordPress database user.

The issue is a stored (second-order) SQL injection rather than a reflected one. Payloads are persisted first, then triggered when a duplication action fires the vulnerable query. This makes the flaw harder to spot with basic request-level filtering.

Root Cause

The root cause is missing input sanitisation and lack of parameterised queries. The plugin does not use $wpdb->prepare() or equivalent placeholder binding when constructing the duplication SQL. WordPress provides esc_sql() and prepared statement APIs for exactly this purpose, but the vulnerable code path bypasses them.

Attack Vector

Exploitation requires a valid account with the Editor role or above. The attacker stores a crafted value through normal plugin functionality, then triggers the duplicate-page action. The injected SQL executes inline with the intended query. Impact includes disclosure of wp_users hashes, extraction of wp_options secrets such as API keys, and modification of arbitrary rows. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-16539

Indicators of Compromise

Unexpected wp_posts entries created shortly after a page duplication event by a non-administrator account
Database error entries in PHP or MySQL logs referencing the plugin's duplication handler
Outbound queries containing SQL meta-characters such as UNION SELECT, SLEEP(, or INFORMATION_SCHEMA originating from Editor sessions
New or modified rows in wp_users or wp_usermeta without corresponding admin activity

Detection Strategies

Enable WordPress query logging and inspect duplication requests for SQL syntax in stored fields
Deploy a Web Application Firewall rule that inspects POST bodies to plugin admin-ajax endpoints for SQL keywords
Correlate authenticated Editor session activity with database anomaly events to surface second-order injection
Review the plugin source for calls that concatenate strings into $wpdb->query() without prepare()

Monitoring Recommendations

Monitor wp-admin access logs for repeated calls to the plugin's duplication action from the same Editor account
Alert on any Editor account performing bulk duplications outside of normal editorial windows
Track schema-metadata queries such as reads from information_schema.tables by the WordPress database user
Baseline normal wpdb query patterns and flag deviations tied to plugin AJAX handlers

How to Mitigate CVE-2026-16539

Immediate Actions Required

Deactivate the SM Page Duplicator plugin until a patched release is available
Audit all accounts with Editor role or higher and remove unnecessary privileges
Rotate WordPress secret keys, database credentials, and any API keys stored in wp_options
Force password resets for all users if database exfiltration cannot be ruled out

Patch Information

At the time of publication, no fixed version is listed for the SM Page Duplicator plugin. The vulnerability affects all versions through 1.0.0. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for a patched release, and remove the plugin from production sites until one is available.

Workarounds

Remove the plugin entirely and use a maintained alternative for page duplication
Restrict the Editor role using a capability manager so untrusted authors cannot reach the duplication action
Deploy WAF signatures blocking SQL meta-characters in POST parameters bound for the plugin's endpoints
Enforce least privilege on the MySQL account used by WordPress, denying FILE and cross-database access

bash

# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate sm-page-duplicator
wp plugin delete sm-page-duplicator

# Audit high-privilege users
wp user list --role=editor --fields=ID,user_login,user_email,user_registered
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered