What is the CVSS score of CVE-2026-16539?

CVE-2026-16539 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of sm page duplicator are affected by CVE-2026-16539?

The SM Page Duplicator WordPress plugin (versions 1.0.0 and prior) contains a SQL injection vulnerability (CVSS 8.1) allowing authenticated Editor-role users to execute arbitrary database queries.

Is there a public PoC exploit available for CVE-2026-16539?

Yes, a public proof-of-concept exploit is available for CVE-2026-16539. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16539?

Immediately audit WordPress installations for SM Page Duplicator plugin versions 1.0.0 and earlier to identify affected sites (24 hours). Within 7 days, disable or remove the plugin from affected sites as no vendor-released patch has been identified; alternatively, restrict Editor role assignment to only trusted users and implement active monitoring of database query logs. Evaluate alternative page duplication plugins with active security maintenance, implement database-level access controls to limit scope of potential SQL injection impact, and establish monthly plugin vulnerability scanning as part of WordPress hardening (30 days).

sm page duplicator CVE-2026-16539

EUVD-2026-52182 HIGH

SQL Injection (CWE-89)

2026-08-03 WPScan

GHSA-7g4m-2955-87xx

WordPress SQLi Sm Page Duplicator Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Editor-role authentication required (PR:L); network-accessible WordPress interface (AV:N); high C and I from full database read/write via SQL injection; no availability impact identified.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:27 vuln.today

CVSS changed

Aug 03, 2026 - 18:22 NVD

8.1 (HIGH)

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.

AnalysisAI

SQL injection in the sm page duplicator WordPress plugin (versions through 1.0.0) allows authenticated users holding the Editor role or above to execute arbitrary SQL against the WordPress database by exploiting an unsanitized stored value consumed during the page duplication workflow. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) signals limited observed exploitation activity and the vulnerability is not listed in CISA KEV. The high CVSS score of 8.1 reflects the potential for full database read and write access, tempered in practice by the requirement for a privileged authenticated account.

Technical ContextAI

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The sm page duplicator plugin (CPE: cpe:2.3:a:unknown:sm_page_duplicator:*:*:*:*:*:*:*:*) follows a second-order SQL injection pattern: user-controlled data is stored to the database in a first request, then retrieved and embedded directly into a SQL statement without sanitization or escaping when the page duplication action is later triggered. WordPress provides parameterized query helpers via $wpdb->prepare() and related APIs specifically to prevent this class of flaw; this plugin bypasses those protections. Second-order injection is notable because WAF-layer detection is less reliable than for direct injection, since the dangerous payload transits the database before reaching the vulnerable query context.

RemediationAI

No vendor-released patch has been identified at time of analysis - the plugin's CPE vendor is listed as 'unknown,' suggesting limited vendor responsiveness. The primary recommended action is to immediately deactivate and uninstall the sm page duplicator plugin from all WordPress installations; this eliminates the attack surface entirely with no functional trade-off beyond losing the page duplication feature, which can be replaced by alternative plugins with active maintenance. As a compensating control for sites that cannot immediately remove the plugin, restrict the WordPress Editor role to only fully trusted users, since the vulnerability is gated behind that privilege level - however, this does not eliminate the flaw and should be treated as temporary. A WAF with SQL injection rules may partially limit exploitation but is less effective against second-order injection patterns where the payload is pre-stored. Monitor the WPScan advisory page (https://wpscan.com/vulnerability/8e2c97d8-5392-4464-94e5-3fc353302f1f/) for any upstream patch release.