CVE-2026-16539
Received Received - Intake

SQL Injection in SM Page Duplicator WordPress Plugin

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: WPScan

Description
The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-16539
EUVD
EUVD-2026-52182

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sm_page_duplicator sm_page_duplicator to 1.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The sm page duplicator WordPress plugin through version 1.0.0 has a stored SQL injection vulnerability. When duplicating a page, the plugin fails to properly sanitize and escape user input before using it in a SQL query. This allows users with Editor role or higher to inject malicious SQL commands.

Detection Guidance

To detect this vulnerability, check if the sm page duplicator WordPress plugin version 1.0.0 or below is installed. Look for unusual SQL query patterns or errors in your web server logs that may indicate SQL injection attempts during page duplication.

Impact Analysis

This vulnerability allows attackers with Editor privileges or above to execute arbitrary SQL commands on your WordPress database. They could steal sensitive data, modify or delete database contents, or take control of your website.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection. Organizations may face fines and penalties for failing to protect sensitive user data due to this security flaw.

Mitigation Strategies

Immediately update the sm page duplicator plugin to the latest version if an update is available. If no update exists, consider disabling or removing the plugin until a patch is released. Restrict Editor role permissions to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16539. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart