CVE-2017-14723 WordPress Core < 4.8.2 - SQL Injection via Mishandled Placeholders
CriticalCVSS 9.8
EPSS 6.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 4.8.2+dfsg-1 | 4.8.2+dfsg-1 |
| debian/wordpress(Debian:13) | < 4.8.2+dfsg-1 | 4.8.2+dfsg-1 |
| debian/wordpress(Debian:14) | < 4.8.2+dfsg-1 | 4.8.2+dfsg-1 |
| WordPress | <= 4.8.1 | No fix listed |
| WordPress(WordPress) | < 3.7 | 3.7 |
| WordPress(WordPress) | >= 3.7, < 3.7.22 | 3.7.22 |
| WordPress(WordPress) | >= 3.8, < 3.8.22 | 3.8.22 |
| WordPress(WordPress) | >= 3.9, < 3.9.20 | 3.9.20 |
| WordPress(WordPress) | >= 4.0, < 4.0.19 | 4.0.19 |
| WordPress(WordPress) | >= 4.1, < 4.1.19 | 4.1.19 |
| WordPress(WordPress) | >= 4.2, < 4.2.16 | 4.2.16 |
| WordPress(WordPress) | >= 4.3, < 4.3.12 | 4.3.12 |
| WordPress(WordPress) | >= 4.4, < 4.4.11 | 4.4.11 |
| WordPress(WordPress) | >= 4.5, < 4.5.10 | 4.5.10 |
| WordPress(WordPress) | >= 4.6, < 4.6.7 | 4.6.7 |
| WordPress(WordPress) | >= 4.7, < 4.7.6 | 4.7.6 |
| WordPress(WordPress) | >= 4.8, < 4.8.2 | 4.8.2 |
References
- Debian Security Tracker CVE-2017-14723 vendor-advisory
- 100912 third-party-advisory vdb-entry
- 1039553 vdb-entry
- core.trac.wordpress.org patch vendor-advisory
- core.trac.wordpress.org patch vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- medium.com exploit mitigation third-party-advisory
- medium.com exploit third-party-advisory
- wordpress.org patch release-notes vendor-advisory
- DSA-3997 vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking