CVE-2026-2893: 
WordPress vulnerability analysis and mitigation

CVE-2026-2893 is a second-order SQL Injection vulnerability in the Page and Post Clone plugin for WordPress, affecting all versions up to and including 6.3. The flaw resides in the content_clone() function, where the meta_key parameter is insufficiently escaped and the SQL query is inadequately prepared. Authenticated attackers with Contributor-level access or above can store a malicious payload as a post meta key, which is then executed when the post is cloned. It was published on March 5, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is insufficient escaping of the user-supplied meta_key value combined with inadequate preparation of the SQL query in the content_clone() function. This is a second-order (stored) SQL injection: an attacker first stores a crafted payload as a post meta key, and the malicious SQL is triggered later when the post is cloned, bypassing any input validation that might occur at write time. The vulnerable code path is visible in the plugin source at line 95 of page-or-post-clone.php (WordPress Trac, Wordfence).

Successful exploitation allows authenticated attackers to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, secret keys, and other site configuration data, resulting in a high confidentiality impact. Integrity and availability are not directly affected by this vulnerability. Because the minimum required privilege is Contributor-level, the attack surface is limited to sites that allow untrusted users to create or edit posts, but the data exposure risk is significant given the sensitive nature of WordPress database contents (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.026% (0.000260), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits opportunistic mass exploitation but remains a realistic threat on sites with open registration (Wordfence, Red Hat CVE).

1. Gain Contributor Access: Register or obtain a WordPress account with at least Contributor-level privileges on the target site running Page and Post Clone ≤ 6.3.
2. Create a Post with Malicious Meta Key: Create or edit a post and add a custom post meta entry where the meta key contains a crafted SQL injection payload (e.g., legitimate_key' UNION SELECT user_login,user_pass,3,4,5,6,7 FROM wp_users-- -).
3. Save the Post: Submit the post, causing the malicious meta key to be stored in the wp_postmeta table without sanitization.
4. Trigger the Clone Operation: Use the Page and Post Clone plugin's clone functionality on the post containing the malicious meta key. This invokes content_clone(), which reads the stored meta key and incorporates it unsafely into a SQL query.
5. Extract Data: The injected SQL executes in the context of the WordPress database user, returning sensitive data (e.g., usernames and password hashes from wp_users) that may be observable via error messages, side-channel timing, or blind injection techniques (Wordfence, WordPress Trac).

• Database: Unusual or malformed entries in the wp_postmeta table where meta_key contains SQL syntax characters such as single quotes ('), UNION, SELECT, --, or #.
• Logs: WordPress or web server access logs showing clone action requests (e.g., ?action=page_or_post_clone or similar) from Contributor-level accounts, particularly in rapid succession or at unusual hours.
• Logs: PHP or MySQL error logs containing SQL syntax errors referencing the content_clone() function or unexpected query structures.
• File System: Unexpected changes to WordPress configuration or user accounts following clone operations, which may indicate successful credential extraction and follow-on compromise.

The vulnerability was remediated in the plugin update committed to the WordPress plugin repository (changeset 3474651). Site administrators should update the Page and Post Clone plugin to version 6.4 or later immediately. As a temporary workaround, restrict Contributor-level user registration or disable the Page and Post Clone plugin until patching is feasible. Additionally, review the wp_postmeta table for suspicious meta key values as a precautionary measure (WordPress Trac Changeset, Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which assigned it and published the advisory on March 5, 2026. Sucuri included it in their March 2026 vulnerability patch roundup, and Cyfirma referenced it in their weekly intelligence report for the week of March 13, 2026, indicating moderate industry awareness. No significant social media controversy or high-profile researcher commentary has been identified beyond standard vulnerability aggregation coverage (Sucuri Blog, Cyfirma).