[Forgot Password]
Login  Register Subscribe

23631

 
 

115084

 
 

97559

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2017-16510

Date: (C)2017-11-04   (M)2017-11-14
 
CVSS Score: 4.3Access Vector:
Exploitability Subscore: Access Complexity:
Impact Subscore: Authentication:
 Confidentiality:
 Integrity:
 Availability:











WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Reference:
BID-101638
https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-technical.html
https://codex.wordpress.org/Version_4.8.3
https://github.com/WordPress/WordPress/commit/a2693fd8602e3263b5925b9d799ddd577202167d
https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/
https://wpvulndb.com/vulnerabilities/8941

© 2013 SecPod Technologies