CVE-2026-16539 PUBLISHED

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

Assigner: WPScan
Reserved: 22.07.2026 Published: 03.08.2026 Updated: 03.08.2026

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.

Product Status

Vendor Unknown
Product sm page duplicator
Versions Default: unknown
  • affected from 0 to 1.0.0 (incl.)

Credits

  • Pablo González Pérez finder
  • Francisco José Ramírez Vicente and Iñigo Sánchez Enciso finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE