CVE-2007-4154

published 2007-08-03

CVE-2007-4154: SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options…

Priority P4 32 medium 6.5 CVSS 2.0

AV N AC L Au S C P I P A P

SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	wordpress	< wordpress 2.2.2-1 (bookworm)	wordpress 2.2.2-1 (bookworm)
wordpress	wordpress	—	—
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1

CVSS provenance

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

osv 6.5 MEDIUM

vendor_debian 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.