Executive brief
The Improved Save Button plugin for WordPress, which adds enhanced publishing options to the editor, contains a security flaw in its 'Save and Duplicate' feature. An attacker with author-level access can exploit this to run unauthorized database commands. This could allow them to steal sensitive information from the website's database, potentially compromising user data or site configuration.
Technical details
The Improved Save Button plugin for WordPress (up to version 1.2.1) is vulnerable to second-order SQL Injection. The vulnerability exists within the 'Save and Duplicate' action due to insufficient escaping of the 'meta_key' custom field parameter and a lack of proper SQL query preparation in the underlying code. An authenticated attacker with Author-level privileges or higher can inject malicious SQL fragments into the database that are later executed in a different context. This allows for the extraction of sensitive information via blind or error-based SQL injection techniques. The issue is rooted in the failure to use the wpdb::prepare() function or similar sanitization methods on user-supplied metadata before it is used in a database query.
Affected products
- labelblanc Improved Save Button <= 1.2.1
Timeline
- 2026-07-30: disclosed: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/improved-save-button/tags/1.2.1/actions/class-lb-save-and-then-action-duplicate.php
- https://plugins.trac.wordpress.org/browser/improved-save-button/tags/1.2.1/actions/class-lb-save-and-then-action-duplicate.php
- https://plugins.trac.wordpress.org/browser/improved-save-button/tags/1.2.1/lib/class-lb-save-and-then-post-save.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a1dbc2ca-eb3f-4c0f-a5c0-28579f694237?source=cve