EUVD-2026-50951
GHSA-mjmr-35x5-p5hh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network vector confirmed; PR:L required for author-level auth; confidentiality only since SQL reads but does not modify data.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Second-order SQL Injection in the Improved Save Button WordPress plugin (all versions ≤ 1.2.1) allows authenticated attackers with author-level access or above to exfiltrate sensitive data from the WordPress database. The flaw arises in the 'Save and Duplicate' feature, where a user-supplied 'meta_key' Custom Field value is stored without adequate escaping, then later incorporated into an insufficiently prepared SQL query when the duplicate action is triggered. No public exploit code or active exploitation has been identified at time of analysis, and with a CVSS score of 6.5 the risk is medium - constrained by the authentication barrier but meaningful in multi-author WordPress environments.
Technical ContextAI
The vulnerability is a classic second-order (stored) SQL injection, classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Unlike first-order injection, the malicious payload is written to the database during an initial save operation and then unsafely re-incorporated into a SQL query when the 'Save and Duplicate' action retrieves and reuses it. The Wordfence reference pinpoints the vulnerable code at two locations in class-lb-save-and-then-action-duplicate.php (lines 173 and 179) and one in lib/class-lb-save-and-then-post-save.php (line 86). Both the insufficient escaping of the user-supplied 'meta_key' parameter and the lack of parameterized (prepared) SQL statements contribute to exploitability. The plugin operates within the WordPress ecosystem, querying the wp_postmeta table, which contains all post metadata across the installation.
RemediationAI
No patched release version was identified in the provided intelligence data - the highest tagged version in the Wordfence and NVD references is 1.2.1, which is itself the vulnerable version. Until a remediated release is confirmed, site administrators should deactivate and remove the Improved Save Button plugin. As a compensating control, restrict author-level or higher role assignment to fully trusted users only, since exploitation requires authenticated access at that privilege tier. Administrators can also use a WordPress security plugin (e.g., Wordfence, Sucuri) with SQL injection firewall rules to block malformed meta_key payloads. Monitor the WordPress.org plugin directory and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a1dbc2ca-eb3f-4c0f-a5c0-28579f694237 for a patched release. Do not re-enable the plugin until a version explicitly resolving this issue is published.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today