Page and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied meta_key value and insufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious payload is stored as a post meta key and executed when the post is cloned.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| carlosfazenda | Fast Page & Post Duplicator | up to 6.3 | — | No fix listed | CNA |
- Fast Page & Post Duplicator Vendorcarlosfazenda Affected up to 6.3 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2893
- 2026-10-03 Alias added: GHSA-3xm9-wqg6-2qvm
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bff-900ca78073a4?source=cve
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/tags/6.3/page-or-post-clone.php#L95
- https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L95
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474651%40page-or-post-clone%2Ftrunk&old=3202933%40page-or-post-clone%2Ftrunk&sfp_email=&sfph_mail=
More carlosfazenda vulnerabilities
- TI-2024-05507 Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-2893 · CVE Program
- CVE-2026-2893 · NVD
- FIRST EPSS
- GHSA-3xm9-wqg6-2qvm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences