CVE-2007-3140 WordPress Core <= 2.2 - SQL Injection
MediumCVSS 6.5
EPSS 7.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | = 2.2 | No fix listed |
| debian/wordpress(Debian:12) | < 2.2.1-1 | 2.2.1-1 |
| debian/wordpress(Debian:13) | < 2.2.1-1 | 2.2.1-1 |
| debian/wordpress(Debian:14) | < 2.2.1-1 | 2.2.1-1 |
| WordPress(WordPress) | < 2.2.1 | 2.2.1 |
References
- 36321 vdb-entry
- 25552 third-party-advisory vendor-advisory
- OpenPKG-SA-2007.021 vendor-advisory
- 24344 vdb-entry
- ADV-2007-2099 vdb-entry
- wordpress-login-sql-injection(34746) vdb-entry
- 4039 exploit
- Debian Security Tracker CVE-2007-3140 vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking