PT-2026-23415 · WordPress · Wordpress Page/Post Clone

Arthur Grimault · CVE-2026-2893 · Published 2026-03-05 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Page and Post Clone plugin versions prior to 6.3

Description The Page and Post Clone plugin for WordPress is susceptible to SQL Injection via the meta key parameter within the content clone() function. This is a result of inadequate escaping of user-provided meta key values and insufficient preparation of the existing SQL query. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing queries, potentially extracting sensitive information from the database. The injection is second-order, meaning the malicious payload is stored as a post meta key and executed during post cloning.

Recommendations Update WordPress Page and Post Clone plugin to a version newer than 6.3.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2893

Affected Products

Wordpress Page/Post Clone

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2893 · Security Note
• https://plugins.trac.wordpress.org/browser/page-or-post-clone/tags/6.3/page-or-post-clone.php#L95 · Note
• https://twitter.com/VulmonFeeds/status/2029523230227108116 · Twitter Post
• https://twitter.com/cyberbivash/status/2029475522158141513 · Twitter Post
• https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L95 · Note
• https://t.me/CVEtracker/46432 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bff-900ca78073a4?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474651%40page-or-post-clone%2Ftrunk&old=3202933%40page-or-post-clone%2Ftrunk&sfp_email=&sfph_mail= · Note