CVE-2026-16539: 
WordPress vulnerability analysis and mitigation

CVE-2026-16539 is an authenticated SQL injection vulnerability in the sm page duplicator WordPress plugin affecting versions through 1.0.0. The flaw allows users with the Editor role or above to perform SQL injection attacks via the page duplication functionality. It was publicly disclosed on 2026-07-24 and assigned a CVSS score of 6.8 (Medium) (WPScan). The vulnerability was discovered and submitted by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso of Telefónica (WPScan).

The root cause is improper neutralization of special elements used in SQL commands (CWE-89), specifically a failure to sanitize and escape a stored value before incorporating it into a SQL statement during the page duplication process (WPScan). An authenticated attacker with at least the Editor role can manipulate a stored value (e.g., a page title or metadata field) such that when the page duplication feature is triggered, the unsanitized input is passed directly into a SQL query. This is a stored SQL injection variant, meaning the malicious payload is persisted in the database before being executed. No public proof-of-concept has been released yet, as WPScan withholds PoC details until the issue is remediated (WPScan).

Successful exploitation allows an authenticated Editor-level user to inject arbitrary SQL commands into the WordPress database, enabling extraction, modification, or deletion of site data — including user credentials, private content, and configuration settings (WPScan, Github Advisory). While the attack requires authentication, compromised or malicious Editor accounts could leverage this to escalate privileges, exfiltrate sensitive data, or corrupt site integrity. The confidentiality, integrity, and availability of the WordPress database are all at risk.

1. Gain Editor Access: Obtain or compromise a WordPress account with the Editor role or higher on a target site running sm page duplicator ≤ 1.0.0.
2. Craft Malicious Payload: Create or edit a page with a title or stored field containing a SQL injection payload (e.g., ' OR 1=1-- - or a UNION-based payload to extract data from the wp_users table).
3. Trigger Page Duplication: Use the sm page duplicator plugin's page duplication feature on the page containing the malicious stored value.
4. SQL Injection Executes: The plugin passes the unsanitized stored value directly into a SQL query during duplication, causing the injected SQL to execute against the WordPress database.
5. Extract or Manipulate Data: Depending on the payload, the attacker can enumerate database contents, extract password hashes, modify user roles, or delete records (WPScan).

• Logs: WordPress database error logs or PHP error logs showing unexpected SQL syntax errors during page duplication operations; access logs showing repeated POST requests to the page duplication endpoint from an Editor-level account.
• Database: Unexpected queries in the database slow query log containing UNION, OR 1=1, or other SQL injection patterns; unauthorized changes to wp_users or wp_options tables.
• Behavior: Unusual page duplication activity from Editor accounts, especially at odd hours or in high volume; unexpected new administrator accounts created in WordPress.

Update the sm page duplicator plugin to version 1.0.1 or later, which contains the fix for this vulnerability (Github Advisory). As interim mitigations, restrict the Editor role and above to fully trusted users only, and consider disabling the plugin if page duplication functionality is not actively needed. Additionally, enforce least-privilege database permissions for the WordPress database user to limit the impact of any SQL injection. Monitor database query logs for anomalous SQL patterns as a detection measure.