An authenticated SQL injection vulnerability in the sm page duplicator WordPress plugin enables malicious users to access or modify sensitive database content.

This is a SQL injection vulnerability (CWE-89) that requires the attacker to have at least low-level authenticated access to the WordPress site. The flaw exists due to improper handling of user-supplied input within the plugin, which can be leveraged to compromise database integrity.

With a CVSS score of 8.1, this vulnerability poses a high risk to organizations. An attacker with minimal privileges could escalate their impact by manipulating database records, potentially leading to the creation of administrative accounts, data theft, or full site compromise.

Immediate Action: Deactivate and remove the sm page duplicator plugin from your WordPress environment until the developer releases a security patch that addresses the SQL injection flaw.

Proactive Monitoring: Review user activity logs for suspicious account behavior or unexpected database modifications performed by low-privileged user roles.

Compensating Controls: Implement strict user role management and restrict access to the plugin functions to only essential personnel until the vulnerability is remediated.

Public Exploit Available: No

The presence of a proof-of-concept elevates the risk of this vulnerability being targeted. Organizations should prioritize the removal of the vulnerable software and audit existing user accounts for any signs of suspicious activity or unauthorized privilege escalation.