Security Alert Summary
The Page and Post Clone plugin for WordPress contains a second-order SQL injection vulnerability in the meta_key parameter of the content_clone() function. Authenticated users with Contributor-level access and above can store a malicious post meta key that is later executed when a post is cloned, which may allow extraction of sensitive data from the database.
CVE Details
- CVE ID: CVE-2026-2893
- Affected plugin or component: Page and Post Clone plugin for WordPress
- Affected versions: All versions up to, and including, 6.3
- Published: March 5, 2026 at 8:15:59 AM
- Last modified: March 5, 2026 at 8:15:59 AM
- CVSS v3.1: Base score 6.5 — Medium; Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Authentication / Privileges / User Interaction: Privileges required: Low (Contributor-level access and above); User interaction: None
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- CWE / weakness: CWE-89 (SQL Injection)
- Fixed version: Not specified in the CVE entry.
Technical Details
The vulnerability is a second-order SQL injection in the content_clone() function. User-supplied values provided as a meta_key are insufficiently escaped and the existing SQL query is not properly prepared, which allows an authenticated user to append additional SQL to queries that run when a post is cloned. Because the malicious payload is stored as post meta and executed later during the cloning process, the injection is classified as second-order: the payload is saved in one operation and triggered in a subsequent operation.
The direct cause is inadequate handling of the meta_key value (insufficient escaping and lack of proper query preparation). The impact described in the CVE is extraction of sensitive information from the database when the injected SQL executes.
How This Could Impact Your Website
Consider a small team managing a site where the site owner assigns Contributor access to external contractors or regular content contributors. A contributor could create or edit a post meta entry that contains a crafted meta_key payload. When another user (for example, an editor or administrator cloning the post) triggers the clone operation, the stored payload executes as part of the SQL query and may return confidential data from the database.
Practical consequences include exposure of internal user email addresses or other stored data, which increases the risk of targeted phishing or social engineering against staff or contractors. The issue does not, based on the CVE details, indicate direct modification of data or denial of service, but it does affect confidentiality by enabling data extraction.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available; note that a fixed version is not specified in the CVE entry.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and database activity for unusual behavior, especially around post creation and cloning operations.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/tags/6.3/page-or-post-clone.php#L95
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L95
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474651%40page-or-post-clone%2Ftrunk&old=3202933%40page-or-post-clone%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bff-900ca78073a4?source=cve
