SQL injection in WordPress - CVE-2017-14723
Published: September 20, 2017 / Updated: October 15, 2017
Vulnerability identifier: #VU8505
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-14723
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: WordPress.ORG
Affected software:
WordPress
WordPress
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary SQL queries in web application database.
The vulnerability exists due to insufficient validation of user-supplied data in $wpdb->prepare(). In certain cases, a remote attacker can execute arbitrary SQL commands in application database.
Successful exploitation of the vulnerability may allow an attacker to gain full access to web application database and compromise the web application.
How to mitigate CVE-2017-14723
Update to version 4.8.2.