Live Copy Paste CVE-2026-93527

Requires an authenticated WordPress account with at least Contributor role (PR:L) on a site running bdthemes Live Copy Paste for Elementor plugin version 1.5.10 or earlier, with Elementor installed. No user interaction is required (UI:N) and the vulnerable endpoint is network-reachable. Limiting factors: the attacker must possess or obtain valid Contributor credentials, so sites that do not allow Contributor-level registration or multi-author access substantially reduce real-world exposure; exploitation is not possible unauthenticated. No non-default plugin configuration is indicated by the available data beyond the plugin simply being installed and active.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection requiring only Contributor-level authentication (PR:L). The impact profile is confidentiality-weighted (C:H) with limited availability impact (A:L) and no integrity impact (I:N), consistent with a read-oriented SQLi that lets a low-privileged user extract arbitrary database contents (WordPress users, password hashes, secrets). The S:C (scope change) reflects the injected query reaching the shared database beyond the plugin's own security authority - a scoring convention Patchstack commonly applies, though a stricter reading would treat same-database SQLi as S:U (which would lower the base score). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.5 is a capability rating, not an exploitation-in-the-wild signal. The realistic priority is moderate: the flaw is genuinely exploitable but gated behind having a valid Contributor account on the target WordPress site, which meaningfully narrows the attacker population versus an unauthenticated bug. On a site that hands out Contributor accounts (multi-author blogs, membership sites), this is a serious privilege-to-data-breach path; on a single-admin site it is largely inert.

An attacker who holds (or registers/phishes) a Contributor account on a WordPress site running Live Copy Paste for Elementor <= 1.5.10 submits a crafted request to the vulnerable plugin endpoint, embedding SQL into an insufficiently sanitized parameter. The injected query executes against the WordPress database, letting the attacker dump sensitive data such as user records and password hashes, escalating from a low-privilege author to full data compromise. No public POC was provided, and exploitation requires an authenticated Contributor session (PR:L), so it cannot be launched fully anonymously.