PT-2026-23415 · WordPress · Wordpress Page/Post Clone

Arthur Grimault · Publicado 2026-03-05 · Atualizado 2026-03-05 · CVE-2026-2893

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Page and Post Clone plugin versions prior to 6.3

Description The Page and Post Clone plugin for WordPress is susceptible to SQL Injection via the meta key parameter within the content clone() function. This is a result of inadequate escaping of user-provided meta key values and insufficient preparation of the existing SQL query. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing queries, potentially extracting sensitive information from the database. The injection is second-order, meaning the malicious payload is stored as a post meta key and executed during post cloning.

Recommendations Update WordPress Page and Post Clone plugin to a version newer than 6.3.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-2893

Produtos afetados

Wordpress Page/Post Clone

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2893 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/page-or-post-clone/tags/6.3/page-or-post-clone.php#L95 · Nota
• https://twitter.com/VulmonFeeds/status/2029523230227108116 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2029475522158141513 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L95 · Nota
• https://t.me/CVEtracker/46432 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bff-900ca78073a4?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474651%40page-or-post-clone%2Ftrunk&old=3202933%40page-or-post-clone%2Ftrunk&sfp_email=&sfph_mail= · Nota