WordPress Vulnerabilities

WP < 7.1.3 - Author+ SQLi via WXR Export

Description

WordPress does not properly validate some post meta values before using them in a database query when exporting content in some cases, which could allow users with Author-level access and above to store a crafted value that results in SQL injection executed when an administrator later performs an export.

Affects WordPress

7.1.2
Fixed in WordPress 7.1.3
7.1.1
Fixed in WordPress 7.1.3
7.1
Fixed in WordPress 7.1.3
7.0.6
Fixed in WordPress 7.0.7
7.0.5
Fixed in WordPress 7.0.7
7.0.4
Fixed in WordPress 7.0.7
7.0.3
Fixed in WordPress 7.0.7
7.0.2
Fixed in WordPress 7.0.7
7.0.1
Fixed in WordPress 7.0.7
7.0
Fixed in WordPress 7.0.7
6.9.9
Fixed in WordPress 6.9.10
6.9.8
Fixed in WordPress 6.9.10
6.9.7
Fixed in WordPress 6.9.10
6.9.6
Fixed in WordPress 6.9.10
6.9.5
Fixed in WordPress 6.9.10
6.9.4
Fixed in WordPress 6.9.10
6.9.3
Fixed in WordPress 6.9.10
6.9.2
Fixed in WordPress 6.9.10
6.9.1
Fixed in WordPress 6.9.10
6.9
Fixed in WordPress 6.9.10
6.8.10
Fixed in WordPress 6.8.11
6.8.9
Fixed in WordPress 6.8.11
6.8.8
Fixed in WordPress 6.8.11
6.8.7
Fixed in WordPress 6.8.11
6.8.6
Fixed in WordPress 6.8.11
6.8.5
Fixed in WordPress 6.8.11
6.8.4
Fixed in WordPress 6.8.11
6.8.3
Fixed in WordPress 6.8.11
6.8.2
Fixed in WordPress 6.8.11
6.8.1
Fixed in WordPress 6.8.11
6.8
Fixed in WordPress 6.8.11
6.7.9
Fixed in WordPress 6.7.10
6.7.8
Fixed in WordPress 6.7.10
6.7.7
Fixed in WordPress 6.7.10
6.7.6
Fixed in WordPress 6.7.10
6.7.5
Fixed in WordPress 6.7.10
6.7.4
Fixed in WordPress 6.7.10
6.7.3
Fixed in WordPress 6.7.10
6.7.2
Fixed in WordPress 6.7.10
6.7.1
Fixed in WordPress 6.7.10
6.7
Fixed in WordPress 6.7.10
6.6.9
Fixed in WordPress 6.6.10
6.6.8
Fixed in WordPress 6.6.10
6.6.7
Fixed in WordPress 6.6.10
6.6.6
Fixed in WordPress 6.6.10
6.6.5
Fixed in WordPress 6.6.10
6.6.4
Fixed in WordPress 6.6.10
6.6.3
Fixed in WordPress 6.6.10
6.6.2
Fixed in WordPress 6.6.10
6.6.1
Fixed in WordPress 6.6.10
6.6
Fixed in WordPress 6.6.10
6.5.12
Fixed in WordPress 6.5.13
6.5.11
Fixed in WordPress 6.5.13
6.5.10
Fixed in WordPress 6.5.13
6.5.9
Fixed in WordPress 6.5.13
6.5.8
Fixed in WordPress 6.5.13
6.5.7
Fixed in WordPress 6.5.13
6.5.6
Fixed in WordPress 6.5.13
6.5.5
Fixed in WordPress 6.5.13
6.5.4
Fixed in WordPress 6.5.13
6.5.3
Fixed in WordPress 6.5.13
6.5.2
Fixed in WordPress 6.5.13
6.5
Fixed in WordPress 6.5.13

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Anthropic
Verified
Yes
WPVDB ID
da37190e-8cc6-463b-926e-43622a7704a5

Timeline

Publicly Published
2026-10-06 (about 13 days ago)
Added
2026-10-06 (about 12 days ago)
Last Updated
2026-10-06 (about 12 days ago)

Other

Published
Title
Published
2024-09-30
Title
WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter
Published
2026-10-03
Title
Ajax Search Pro < 4.29.2 - Unauthenticated SQL Injection
Published
2026-09-21
Title
Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
Published
2026-07-23
Title
Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.2 - Authenticated (Contributor+) SQL Injection
Published
2026-01-28
Title
Electio Core <= 1.4 - Unauthenticated SQL Injection