Vulnerability Description
The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied meta_key value and insufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious payload is stored as a post meta key and executed when the post is cloned.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/tags/6.3/page-or-p
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
- https://www.wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bf
FAQ
What is CVE-2026-2893?
CVE-2026-2893 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to, and including, 6.3. This is due to insuf...
How severe is CVE-2026-2893?
CVE-2026-2893 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-2893?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.