WordPress Vulnerabilities

WordPress 3.5-4.7.1 - WP_Query SQL Injection

Affects WordPress

3.8.1
Fixed in WordPress 3.8.18
3.8
Fixed in WordPress 3.8.18
3.7.1
Fixed in WordPress 3.7.18
3.6
Fixed in WordPress 4.7.2
3.5.2
Fixed in WordPress 4.7.2
3.5.1
Fixed in WordPress 4.7.2
3.5
Fixed in WordPress 4.7.2
3.6.1
Fixed in WordPress 4.7.2
3.9
Fixed in WordPress 3.9.16
3.9.1
Fixed in WordPress 3.9.16
3.7
Fixed in WordPress 3.7.18
3.8.2
Fixed in WordPress 3.8.18
3.8.3
Fixed in WordPress 3.8.18
3.9.2
Fixed in WordPress 3.9.16
4.0
Fixed in WordPress 4.0.15
4.1
Fixed in WordPress 4.1.15
4.1.1
Fixed in WordPress 4.1.15
4.2
Fixed in WordPress 4.2.12
3.9.3
Fixed in WordPress 3.9.16
4.1.2
Fixed in WordPress 4.1.15
4.2.1
Fixed in WordPress 4.2.12
4.0.1
Fixed in WordPress 4.0.15
4.1.5
Fixed in WordPress 4.1.15
4.1.4
Fixed in WordPress 4.1.15
4.1.3
Fixed in WordPress 4.1.15
3.8.4
Fixed in WordPress 3.8.18
3.7.4
Fixed in WordPress 3.7.18
4.2.3
Fixed in WordPress 4.2.12
3.8.8
Fixed in WordPress 3.8.18
3.8.5
Fixed in WordPress 3.8.18
3.8.6
Fixed in WordPress 3.8.18
3.8.7
Fixed in WordPress 3.8.18
3.7.2
Fixed in WordPress 3.7.18
3.7.3
Fixed in WordPress 3.7.18
3.7.5
Fixed in WordPress 3.7.18
3.7.6
Fixed in WordPress 3.7.18
3.7.7
Fixed in WordPress 3.7.18
3.7.8
Fixed in WordPress 3.7.18
3.7.9
Fixed in WordPress 3.7.18
3.8.9
Fixed in WordPress 3.8.18
3.9.4
Fixed in WordPress 3.9.16
3.9.5
Fixed in WordPress 3.9.16
3.9.6
Fixed in WordPress 3.9.16
3.9.7
Fixed in WordPress 3.9.16
4.0.2
Fixed in WordPress 4.0.15
4.0.3
Fixed in WordPress 4.0.15
4.0.4
Fixed in WordPress 4.0.15
4.0.5
Fixed in WordPress 4.0.15
4.0.6
Fixed in WordPress 4.0.15
4.1.6
Fixed in WordPress 4.1.15
4.2.2
Fixed in WordPress 4.2.12
4.2.4
Fixed in WordPress 4.2.12
4.1.7
Fixed in WordPress 4.1.15
4.0.7
Fixed in WordPress 4.0.15
3.9.8
Fixed in WordPress 3.9.16
3.8.10
Fixed in WordPress 3.8.18
3.7.10
Fixed in WordPress 3.7.18
4.3
Fixed in WordPress 4.3.8
4.3.1
Fixed in WordPress 4.3.8
4.2.5
Fixed in WordPress 4.2.12
4.1.8
Fixed in WordPress 4.1.15
4.0.8
Fixed in WordPress 4.0.15
3.9.9
Fixed in WordPress 3.9.16
3.8.11
Fixed in WordPress 3.8.18
3.7.11
Fixed in WordPress 3.7.18
4.4
Fixed in WordPress 4.4.7
3.7.12
Fixed in WordPress 3.7.18
3.8.12
Fixed in WordPress 3.8.18
3.9.10
Fixed in WordPress 3.9.16
4.0.9
Fixed in WordPress 4.0.15
4.1.9
Fixed in WordPress 4.1.15
4.2.6
Fixed in WordPress 4.2.12
4.3.2
Fixed in WordPress 4.3.8
4.4.1
Fixed in WordPress 4.4.7
4.4.2
Fixed in WordPress 4.4.7
4.3.3
Fixed in WordPress 4.3.8
4.2.7
Fixed in WordPress 4.2.12
4.1.10
Fixed in WordPress 4.1.15
4.0.10
Fixed in WordPress 4.0.15
3.9.11
Fixed in WordPress 3.9.16
3.8.13
Fixed in WordPress 3.8.18
3.7.13
Fixed in WordPress 3.7.18
4.5
Fixed in WordPress 4.5.6
4.5.1
Fixed in WordPress 4.5.6
3.7.14
Fixed in WordPress 3.7.18
3.8.14
Fixed in WordPress 3.8.18
3.9.12
Fixed in WordPress 3.9.16
4.0.11
Fixed in WordPress 4.0.15
4.1.11
Fixed in WordPress 4.1.15
4.2.8
Fixed in WordPress 4.2.12
4.3.4
Fixed in WordPress 4.3.8
4.4.3
Fixed in WordPress 4.4.7
4.5.2
Fixed in WordPress 4.5.6
4.5.3
Fixed in WordPress 4.5.6
3.7.15
Fixed in WordPress 3.7.18
3.8.15
Fixed in WordPress 3.8.18
3.9.13
Fixed in WordPress 3.9.16
4.0.12
Fixed in WordPress 4.0.15
4.1.12
Fixed in WordPress 4.1.15
4.2.9
Fixed in WordPress 4.2.12
4.3.5
Fixed in WordPress 4.3.8
4.4.4
Fixed in WordPress 4.4.7
4.6
Fixed in WordPress 4.6.3
3.7.16
Fixed in WordPress 3.7.18
3.8.16
Fixed in WordPress 3.8.18
3.9.14
Fixed in WordPress 3.9.16
4.0.13
Fixed in WordPress 4.0.15
4.1.13
Fixed in WordPress 4.1.15
4.2.10
Fixed in WordPress 4.2.12
4.3.6
Fixed in WordPress 4.3.8
4.4.5
Fixed in WordPress 4.4.7
4.5.4
Fixed in WordPress 4.5.6
4.6.1
Fixed in WordPress 4.6.3
4.7
Fixed in WordPress 4.7.2
3.7.17
Fixed in WordPress 3.7.18
3.8.17
Fixed in WordPress 3.8.18
3.9.15
Fixed in WordPress 3.9.16
4.0.14
Fixed in WordPress 4.0.15
4.1.14
Fixed in WordPress 4.1.15
4.2.11
Fixed in WordPress 4.2.12
4.3.7
Fixed in WordPress 4.3.8
4.4.6
Fixed in WordPress 4.4.7
4.5.5
Fixed in WordPress 4.5.6
4.7.1
Fixed in WordPress 4.7.2
4.6.2
Fixed in WordPress 4.6.3

References

CVE
CVE-2017-5611
URL
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
URL
https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
9.8 (critical)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
481e3398-ed2e-460a-af67-ff58027901d1

Timeline

Publicly Published
2017-01-26 (about 6 years ago)
Added
2017-01-26 (about 6 years ago)
Last Updated
2020-09-22 (about 3 years ago)

Other

Published
Title
Published
2014-08-01
Title
Copperleaf Photolog - SQL injection
Published
2022-02-16
Title
WP Statistics < 13.1.6 - Unauthenticated Blind SQL Injection via IP
Published
2023-07-20
Title
Onepage Builder <= 2.4.1 - Admin+ SQLi
Published
2023-03-22
Title
Waiting: One-click Countdowns <= 0.6.2 - Subscriber+ SQLi
Published
2017-06-30
Title
WP Statistics <= 12.0.7 - Authenticated SQL Injection