CVE-2026-2893
📋 TL;DR
The Page and Post Clone WordPress plugin contains a second-order SQL injection vulnerability in the content_clone() function. Authenticated attackers with Contributor-level access or higher can inject malicious SQL via the 'meta_key' parameter, which gets stored and executed when posts are cloned, potentially allowing database information extraction. This affects all WordPress sites using vulnerable plugin versions.
💻 Affected Systems
- WordPress Page and Post Clone plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of sensitive data like user credentials, private content, and configuration secrets, potentially leading to site takeover.
Likely Case
Extraction of post content, user information, and plugin/theme configuration data from the WordPress database.
If Mitigated
Limited impact if proper input validation and prepared statements are implemented, restricting data access to authorized tables only.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The second-order nature means payloads are stored and executed later.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Page and Post Clone' and click 'Update Now' if available. 4. If no update appears, manually download version 6.4+ from WordPress.org and replace the plugin files via FTP/SFTP.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Page and Post Clone plugin until patched
wp plugin deactivate page-or-post-clone
Restrict user roles
allTemporarily remove Contributor and higher roles from untrusted users
wp user remove-role <username> contributor
wp user remove-role <username> author
wp user remove-role <username> editor
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns in POST requests to WordPress admin endpoints
- Enable database activity monitoring to detect unusual SQL queries from WordPress application user
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Page and Post Clone' version ≤6.3Check Version:
wp plugin get page-or-post-clone --field=versionVerify Fix Applied:
Verify plugin version is ≥6.4 in WordPress admin panel or check that the content_clone() function uses prepared statements with $wpdb->prepare()📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from WordPress application user containing UNION, SELECT FROM, or other injection patterns
- Multiple failed login attempts followed by successful Contributor/Author/Editor login
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with SQL patterns in parameters
- Unusual outbound database connections from web server
SIEM Query:
source="wordpress.log" AND ("action=content_clone" OR "meta_key="*SQL*" OR "wp_page_or_post_clone")🔗 References
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/tags/6.3/page-or-post-clone.php#L95
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L95
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474651%40page-or-post-clone%2Ftrunk&old=3202933%40page-or-post-clone%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bff-900ca78073a4?source=cve
