CVE-2007-0233
First published: Sat Jan 13 2007(Updated: )
wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress | =2.0 | |
| WordPress | =2.0.2 | |
| WordPress | =2.0.6 | |
| WordPress | =2.0.1 | |
| WordPress | =2.0.4 | |
| WordPress | =0.6.2.1-beta_2 | |
| WordPress | =1.2.1 | |
| WordPress | =0.7 | |
| WordPress | =0.71 | |
| WordPress | =2.0.5 | |
| WordPress | =1.5.2 | |
| WordPress | =2.0.3 | |
| WordPress | =1.5.1.2 | |
| WordPress | =1.2 | |
| WordPress | =1.2.2 | |
| WordPress | =1.5 | |
| WordPress | =1.5.1 | |
| WordPress | =0.6.2-beta_2 | |
| WordPress | =1.5.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2007-0233?
CVE-2007-0233 has a high severity rating due to its ability to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2007-0233?
To fix CVE-2007-0233, upgrade your WordPress installation to version 2.0.7 or later.
Which versions of WordPress are affected by CVE-2007-0233?
CVE-2007-0233 affects WordPress versions 2.0.6 and earlier.
Can CVE-2007-0233 lead to data exposure?
Yes, CVE-2007-0233 can lead to unauthorized access and potential data exposure due to SQL injection.
Is my site safe if it's running on WordPress version 2.0.6?
No, if your site is running on WordPress version 2.0.6, it is vulnerable to CVE-2007-0233 and should be updated immediately.
- agent/references
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/wordpress
- canonical/wordpress
- version/wordpress/2.0
- version/wordpress/2.0.2
- version/wordpress/2.0.6
- version/wordpress/2.0.1
- version/wordpress/2.0.4
- version/wordpress/0.6.2.1-beta_2
- version/wordpress/1.2.1
- version/wordpress/0.7
- version/wordpress/0.71
- version/wordpress/2.0.5
- version/wordpress/1.5.2
- version/wordpress/2.0.3
- version/wordpress/1.5.1.2
- version/wordpress/1.2
- version/wordpress/1.2.2
- version/wordpress/1.5
- version/wordpress/1.5.1
- version/wordpress/0.6.2-beta_2
- version/wordpress/1.5.1.3