WordPress Vulnerabilities

WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection

Affects WordPress

3.8.1
Fixed in WordPress 3.8.22
3.8
Fixed in WordPress 3.8.22
3.7.1
Fixed in WordPress 3.7.22
3.6
Fixed in WordPress 4.8.2
3.5.2
Fixed in WordPress 4.8.2
3.5.1
Fixed in WordPress 4.8.2
3.5
Fixed in WordPress 4.8.2
3.4.2
Fixed in WordPress 4.8.2
3.4.1
Fixed in WordPress 4.8.2
3.4
Fixed in WordPress 4.8.2
3.3.3
Fixed in WordPress 4.8.2
3.3.2
Fixed in WordPress 4.8.2
3.3.1
Fixed in WordPress 4.8.2
3.3
Fixed in WordPress 4.8.2
3.2.1
Fixed in WordPress 4.8.2
3.2
Fixed in WordPress 4.8.2
3.1.4
Fixed in WordPress 4.8.2
3.1.3
Fixed in WordPress 4.8.2
3.1.2
Fixed in WordPress 4.8.2
3.1.1
Fixed in WordPress 4.8.2
3.1
Fixed in WordPress 4.8.2
3.0.6
Fixed in WordPress 4.8.2
3.0.5
Fixed in WordPress 4.8.2
3.0.4
Fixed in WordPress 4.8.2
3.0.3
Fixed in WordPress 4.8.2
3.0.2
Fixed in WordPress 4.8.2
3.0.1
Fixed in WordPress 4.8.2
3.0
Fixed in WordPress 4.8.2
2.9.2
Fixed in WordPress 4.8.2
2.9.1
Fixed in WordPress 4.8.2
2.9
Fixed in WordPress 4.8.2
2.8.6
Fixed in WordPress 4.8.2
2.8.5
Fixed in WordPress 4.8.2
2.8.4
Fixed in WordPress 4.8.2
2.8.3
Fixed in WordPress 4.8.2
2.8.2
Fixed in WordPress 4.8.2
2.8.1
Fixed in WordPress 4.8.2
2.8
Fixed in WordPress 4.8.2
2.7.1
Fixed in WordPress 4.8.2
2.7
Fixed in WordPress 4.8.2
2.6.5
Fixed in WordPress 4.8.2
2.6.3
Fixed in WordPress 4.8.2
2.6.2
Fixed in WordPress 4.8.2
2.6.1
Fixed in WordPress 4.8.2
2.6
Fixed in WordPress 4.8.2
2.5.1
Fixed in WordPress 4.8.2
2.5
Fixed in WordPress 4.8.2
2.3.3
Fixed in WordPress 4.8.2
2.3.2
Fixed in WordPress 4.8.2
2.3.1
Fixed in WordPress 4.8.2
2.3
Fixed in WordPress 4.8.2
3.6.1
Fixed in WordPress 4.8.2
3.9
Fixed in WordPress 3.9.20
3.9.1
Fixed in WordPress 3.9.20
3.7
Fixed in WordPress 3.7.22
3.8.2
Fixed in WordPress 3.8.22
3.8.3
Fixed in WordPress 3.8.22
3.9.2
Fixed in WordPress 3.9.20
4.0
Fixed in WordPress 4.0.19
4.1
Fixed in WordPress 4.1.19
4.1.1
Fixed in WordPress 4.1.19
4.2
Fixed in WordPress 4.2.16
3.9.3
Fixed in WordPress 3.9.20
4.1.2
Fixed in WordPress 4.1.19
4.2.1
Fixed in WordPress 4.2.16
4.0.1
Fixed in WordPress 4.0.19
4.1.5
Fixed in WordPress 4.1.19
4.1.4
Fixed in WordPress 4.1.19
4.1.3
Fixed in WordPress 4.1.19
3.8.4
Fixed in WordPress 3.8.22
3.7.4
Fixed in WordPress 3.7.22
4.2.3
Fixed in WordPress 4.2.16
3.8.8
Fixed in WordPress 3.8.22
3.8.5
Fixed in WordPress 3.8.22
3.8.6
Fixed in WordPress 3.8.22
3.8.7
Fixed in WordPress 3.8.22
3.7.2
Fixed in WordPress 3.7.22
3.7.3
Fixed in WordPress 3.7.22
3.7.5
Fixed in WordPress 3.7.22
3.7.6
Fixed in WordPress 3.7.22
3.7.7
Fixed in WordPress 3.7.22
3.7.8
Fixed in WordPress 3.7.22
3.7.9
Fixed in WordPress 3.7.22
3.8.9
Fixed in WordPress 3.8.22
3.9.4
Fixed in WordPress 3.9.20
3.9.5
Fixed in WordPress 3.9.20
3.9.6
Fixed in WordPress 3.9.20
3.9.7
Fixed in WordPress 3.9.20
4.0.2
Fixed in WordPress 4.0.19
4.0.3
Fixed in WordPress 4.0.19
4.0.4
Fixed in WordPress 4.0.19
4.0.5
Fixed in WordPress 4.0.19
4.0.6
Fixed in WordPress 4.0.19
4.1.6
Fixed in WordPress 4.1.19
4.2.2
Fixed in WordPress 4.2.16
4.2.4
Fixed in WordPress 4.2.16
4.1.7
Fixed in WordPress 4.1.19
4.0.7
Fixed in WordPress 4.0.19
3.9.8
Fixed in WordPress 3.9.20
3.8.10
Fixed in WordPress 3.8.22
3.7.10
Fixed in WordPress 3.7.22
4.3
Fixed in WordPress 4.3.12
4.3.1
Fixed in WordPress 4.3.12
4.2.5
Fixed in WordPress 4.2.16
4.1.8
Fixed in WordPress 4.1.19
4.0.8
Fixed in WordPress 4.0.19
3.9.9
Fixed in WordPress 3.9.20
3.8.11
Fixed in WordPress 3.8.22
3.7.11
Fixed in WordPress 3.7.22
4.4
Fixed in WordPress 4.4.11
3.7.12
Fixed in WordPress 3.7.22
3.8.12
Fixed in WordPress 3.8.22
3.9.10
Fixed in WordPress 3.9.20
4.0.9
Fixed in WordPress 4.0.19
4.1.9
Fixed in WordPress 4.1.19
4.2.6
Fixed in WordPress 4.2.16
4.3.2
Fixed in WordPress 4.3.12
4.4.1
Fixed in WordPress 4.4.11
4.4.2
Fixed in WordPress 4.4.11
4.3.3
Fixed in WordPress 4.3.12
4.2.7
Fixed in WordPress 4.2.16
4.1.10
Fixed in WordPress 4.1.19
4.0.10
Fixed in WordPress 4.0.19
3.9.11
Fixed in WordPress 3.9.20
3.8.13
Fixed in WordPress 3.8.22
3.7.13
Fixed in WordPress 3.7.22
4.5
Fixed in WordPress 4.5.10
4.5.1
Fixed in WordPress 4.5.10
3.7.14
Fixed in WordPress 3.7.22
3.8.14
Fixed in WordPress 3.8.22
3.9.12
Fixed in WordPress 3.9.20
4.0.11
Fixed in WordPress 4.0.19
4.1.11
Fixed in WordPress 4.1.19
4.2.8
Fixed in WordPress 4.2.16
4.3.4
Fixed in WordPress 4.3.12
4.4.3
Fixed in WordPress 4.4.11
4.5.2
Fixed in WordPress 4.5.10
4.5.3
Fixed in WordPress 4.5.10
3.7.15
Fixed in WordPress 3.7.22
3.8.15
Fixed in WordPress 3.8.22
3.9.13
Fixed in WordPress 3.9.20
4.0.12
Fixed in WordPress 4.0.19
4.1.12
Fixed in WordPress 4.1.19
4.2.9
Fixed in WordPress 4.2.16
4.3.5
Fixed in WordPress 4.3.12
4.4.4
Fixed in WordPress 4.4.11
4.6
Fixed in WordPress 4.8.2
3.7.16
Fixed in WordPress 3.7.22
3.8.16
Fixed in WordPress 3.8.22
3.9.14
Fixed in WordPress 3.9.20
4.0.13
Fixed in WordPress 4.0.19
4.1.13
Fixed in WordPress 4.1.19
4.2.10
Fixed in WordPress 4.2.16
4.3.6
Fixed in WordPress 4.3.12
4.4.5
Fixed in WordPress 4.4.11
4.5.4
Fixed in WordPress 4.5.10
4.6.1
Fixed in WordPress 4.6.7
4.7
Fixed in WordPress 4.7.6
3.7.17
Fixed in WordPress 3.7.22
3.8.17
Fixed in WordPress 3.8.22
3.9.15
Fixed in WordPress 3.9.20
4.0.14
Fixed in WordPress 4.0.19
4.1.14
Fixed in WordPress 4.1.19
4.2.11
Fixed in WordPress 4.2.16
4.3.7
Fixed in WordPress 4.3.12
4.4.6
Fixed in WordPress 4.4.11
4.5.5
Fixed in WordPress 4.5.10
4.7.1
Fixed in WordPress 4.7.6
4.6.2
Fixed in WordPress 4.6.7
3.7.18
Fixed in WordPress 3.7.22
3.8.18
Fixed in WordPress 3.8.22
3.9.16
Fixed in WordPress 3.9.20
4.0.15
Fixed in WordPress 4.0.19
4.1.15
Fixed in WordPress 4.1.19
4.2.12
Fixed in WordPress 4.2.16
4.3.8
Fixed in WordPress 4.3.12
4.4.7
Fixed in WordPress 4.4.11
4.5.6
Fixed in WordPress 4.5.10
4.6.3
Fixed in WordPress 4.6.7
4.7.2
Fixed in WordPress 4.7.6
3.7.19
Fixed in WordPress 3.7.22
3.8.19
Fixed in WordPress 3.8.22
3.9.17
Fixed in WordPress 3.9.20
4.0.16
Fixed in WordPress 4.0.19
4.1.16
Fixed in WordPress 4.1.19
4.2.13
Fixed in WordPress 4.2.16
4.3.9
Fixed in WordPress 4.3.12
4.4.8
Fixed in WordPress 4.4.11
4.5.7
Fixed in WordPress 4.5.10
4.6.4
Fixed in WordPress 4.6.7
4.7.3
Fixed in WordPress 4.7.6
3.7.20
Fixed in WordPress 3.7.22
3.8.20
Fixed in WordPress 3.8.22
3.9.18
Fixed in WordPress 3.9.20
4.0.17
Fixed in WordPress 4.0.19
4.1.17
Fixed in WordPress 4.1.19
4.2.14
Fixed in WordPress 4.2.16
4.3.10
Fixed in WordPress 4.3.12
4.4.9
Fixed in WordPress 4.4.11
4.5.8
Fixed in WordPress 4.5.10
4.6.5
Fixed in WordPress 4.6.7
4.7.4
Fixed in WordPress 4.7.6
4.7.5
Fixed in WordPress 4.7.6
3.7.21
Fixed in WordPress 3.7.22
3.8.21
Fixed in WordPress 3.8.22
3.9.19
Fixed in WordPress 3.9.20
4.0.18
Fixed in WordPress 4.0.19
4.1.18
Fixed in WordPress 4.1.19
4.2.15
Fixed in WordPress 4.2.16
4.3.11
Fixed in WordPress 4.3.12
4.4.10
Fixed in WordPress 4.4.11
4.5.9
Fixed in WordPress 4.5.10
4.6.6
Fixed in WordPress 4.6.7
4.8
Fixed in WordPress 4.8.2
4.8.1
Fixed in WordPress 4.8.2

References

CVE
CVE-2017-14723
URL
https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
URL
https://github.com/WordPress/WordPress/commit/70b21279098fc973eae803693c0705a548128e48
URL
https://github.com/WordPress/WordPress/commit/fc930d3daed1c3acef010d04acc2c5de93cd18ec

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
9.8 (critical)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
9b3414c0-b33b-4c55-adff-718ff4c3195d

Timeline

Publicly Published
2017-09-19 (about 8 years ago)
Added
2017-09-20 (about 8 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2024-08-26
Title
WP Testimonial Widget <= 3.1 - Authenticated (Admin+) SQL Injection
Published
2025-12-14
Title
Store Locator WordPress < 1.6.3 - Authenticated (Contributor+) SQL Injection
Published
2024-04-07
Title
Slideshow Gallery < 1.7.9 - Contributor+ SQLi
Published
2024-08-19
Title
Shopping Cart & eCommerce Store < 5.7.3 - Authenticated (Contributor+) SQL Injection via model_number Parameter
Published
2023-12-05
Title
Soledad < 8.4.2 - Authenticated (Contributor+) SQL Injection