CVE-2017-5611
published 2017-01-30CVE-2017-5611: SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands…
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wordpress | < wordpress 4.7.2+dfsg-1 (bookworm) | wordpress 4.7.2+dfsg-1 (bookworm) |
| oracle | data_integrator | — | — |
| oracle | data_integrator | — | — |
| oracle | data_integrator | — | — |
| wordpress | wordpress | <= 4.7.1 | — |
| wordpress | wordpress | >= 0 < 4.7.2+dfsg-1 | 4.7.2+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.2+dfsg-1 | 4.7.2+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.2+dfsg-1 | 4.7.2+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.2+dfsg-1 | 4.7.2+dfsg-1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vulncheck9.8CRITICAL