Published: 23/09/2017 Updated: 10/11/2017
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.

Vendor Advisories

Debian Bug report logs - #876274 wordpress: 9 security bugs in wordpress 481 and earlier Package: src:wordpress; Maintainer for src:wordpress is Craig Small <csmall@debianorg>; Reported by: Craig Small <csmall@debianorg> Date: Wed, 20 Sep 2017 12:24:01 UTC Severity: grave Tags: security, upstream Found in versio ...
Debian Bug report logs - #877629 wordpress: CVE-2017-14990 Package: src:wordpress; Maintainer for src:wordpress is Craig Small <csmall@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 3 Oct 2017 15:21:02 UTC Severity: important Tags: security, upstream Found in version wordpress/482+d ...
Several vulnerabilities were discovered in Wordpress, a web blogging tool They would allow remote attackers to exploit path-traversal issues, perform SQL injections and various cross-site scripting attacks For the oldstable distribution (jessie), these problems have been fixed in version 41+dfsg-1+deb8u15 For the stable distribution (stretch), ...

Github Repositories

Analyse von vier Sicherheitslücken in Wordpress

Sicherheit von Wordpress In-depth analyse und Proof-Of-Concept Exploits der folgenden CVEs: SQL-Injection: CVE-2017-14723 XSS: CVE-2017-14718, CVE-2017-14721 Phar-Unserialisation: CVE-2018-20148 Dokumente Enthält das Whitepaper und die von uns genutzten Präsentationsslides POC Enthält die von uns bei den Livedemos benutzten Proof-Of-Concept Exploits

Recent Articles

WordPress Delivers Second Patch For SQL Injection Bug
Threatpost • Tom Spring • 01 Nov 2017

A bug exploitable in WordPress 4.8.2 and earlier creates unexpected and unsafe conditions ripe for a SQL injection attack, exposing sites created on the content management system to takeover.
WordPress released WordPress 4.8.3 Tuesday, which mitigates the vulnerability.
“This is a security release for all previous versions and we strongly encourage you to update your sites immediately,” according to WordPress. The vulnerability is not tied to the WordPress Core, rather plugins an...