CVE-2026-16092

CVE-2026-16092 is a second-order SQL injection in the 'Improved Save Button' WordPress plugin, specifically in the 'Save and Duplicate' functionality. The vulnerability operates on a temporal logic that single-pass code review easily misses: the plugin correctly sanitizes meta_key when a custom field is initially saved, but treats that stored value as trusted when the duplicate action retrieves it to construct a database query. The attacker stores a malicious meta_key through a normal custom field save, then triggers the duplicate action to inject that payload into a $wpdb->prepare() call that lacks proper parameterization. If you run this plugin, the immediate check is straightforward: examine the plugin's code for any $wpdb->prepare() calls that incorporate $_POST, $_GET, or stored meta values without explicit sanitization—specifically around any 'duplicate' or 'copy' action handlers. WordPress provides prepare() for exactly this scenario, and it must be used every time user-controlled data enters a query, regardless of whether that data originated from a database read or a direct request. The deeper lesson is that WordPress's meta_key handling remains a structural weakness in the plugin ecosystem. sanitize_key() exists and sounds security-relevant, but it validates format (alphanumeric, underscores, hyphens, 191-character limit) without preventing SQL injection—it operates on the wrong threat model entirely. The function that actually prevents this class of injection, $wpdb->prepare(), is well-documented but never prominently signaled as mandatory for meta_key operations. Developers who reach for sanitize_key() believe they've discharged their security obligation when they haven't. Regarding the author-level access requirement: treat this as a single authentication step, not a security boundary. WordPress author accounts can install plugins, edit theme files, and activate plugins that execute arbitrary PHP—capabilities that place them inside the same trust perimeter as administrators for most realistic attack scenarios. Credential stuffing, phishing, and plugin-to-author privilege escalation routinely grant attackers author-equivalent access on WordPress sites that haven't hardened beyond the default configuration.

Reviewed through automated stages and approved by a human before publication.