CVE-2026-16092 describes a second-order SQL Injection vulnerability in the labelblanc Improved Save Button WordPress plugin. The issue exists in the handling of the 'meta_key' Custom Field during the 'Save and Duplicate' action, where user input is not properly escaped or prepared before being incorporated into SQL queries. This allows authenticated attackers with author-level privileges or higher to inject additional SQL commands into existing queries, enabling unauthorized data extraction from the database. The vulnerability affects all plugin versions up to and including 1.2.1. There is no vendor advisory or patch information currently available, and no known exploits have been reported in the wild.

Successful exploitation allows an authenticated user with author-level access or higher to perform second-order SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure, as per the CVSS vector (Confidentiality: High, Integrity: None, Availability: None).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and monitor for suspicious activity related to the 'Save and Duplicate' action. Avoid using the affected plugin versions if possible.