CVE-2017-14723

Description

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.

Weakness classification

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references

• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org
• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org — Issue Tracking, Patch, Third Party Advisory
• cve@mitre.org — Issue Tracking, Patch, Third Party Advisory
• cve@mitre.org — Exploit, Mitigation, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Patch, Release Notes, Vendor Advisory
• cve@mitre.org
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108