CVE-2026-2893

The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied meta_key value and insufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious payload is stored as a post meta key and executed when the post is cloned.

• CWE-89

• https://plugins.trac.wordpress.org/browser/page-or-post-clone/tags/6.3/page-or-post-clone.php#L95
• https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L95
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474651%40page-or-post-clone%2Ftrunk&old=3202933%40page-or-post-clone%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bff-900ca78073a4?source=cve

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28923A logging issue was addressed with improved data redaction. …8.8
• CVE-2026-28924A race condition was addressed with improved handling of sym…7.5
• CVE-2026-28925A buffer overflow was addressed with improved bounds checkin…7.5
• CVE-2026-28926A race condition was addressed with improved state handling.…7
• CVE-2026-28928A use after free issue was addressed with improved memory ma…9.8
• CVE-2026-28929A logic issue was addressed with improved checks. This issue…7.5
• CVE-2026-28930A permissions issue was addressed with additional restrictio…7.5
• CVE-2026-28931A buffer overflow was addressed with improved bounds checkin…8.8
• CVE-2026-28932A logic issue existed resulting in memory corruption. This w…5.5
• CVE-2026-28936The issue was addressed with improved checks. This issue is …7.5
• CVE-2026-2894A vulnerability was identified in funadmin up to 7.1.0-rc4. …9.1
• CVE-2026-28940The issue was addressed with improved memory handling. This …8.8