CVE-2017-16510

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

References

Affected packages

Git / github.com/wordpress/wordpress

Affected ranges

Type

GIT

Repo

https://github.com/wordpress/wordpress

Events

Introduced

Last Affected

3a101dd37d14b5e78c80ba5c67f1dafc4b07e7ee

Fixed

a2693fd8602e3263b5925b9d799ddd577202167d

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "4.8.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "a2693fd8602e3263b5925b9d799ddd577202167d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

4.*

4.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16510.json"

Git / github.com/wordpress/wordpress-develop