#VU8505 SQL injection in WordPress - CVE-2017-14723
Published: September 20, 2017 / Updated: October 15, 2017
Vulnerability identifier: #VU8505
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-14723
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
WordPress
WordPress
Software vendor:
WordPress.ORG
WordPress.ORG
Description
The vulnerability allows a remote attacker to execute arbitrary SQL queries in web application database.
The vulnerability exists due to insufficient validation of user-supplied data in $wpdb->prepare(). In certain cases, a remote attacker can execute arbitrary SQL commands in application database.
Successful exploitation of the vulnerability may allow an attacker to gain full access to web application database and compromise the web application.
Remediation
Update to version 4.8.2.