CVE-2017-14723: SQL Injection
Published Sep 23, 2017
·Updated
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
Affected Software
2 affected componentsFixes available
debian/wordpress
5.0.15+dfsg1-0+deb10u15.0.19+dfsg1-0+deb10u15.7.8+dfsg1-0+deb11u26.1.1+dfsg1-16.3.1+dfsg1-1
WordPress<=4.8.1
Remediation
Patch Available
Patch Available
Event History
Sep 23, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14723?
CVE-2017-14723 is classified as a high severity vulnerability due to its potential to allow SQL injection attacks.
2
How do I fix CVE-2017-14723?
To fix CVE-2017-14723, update WordPress to version 4.8.2 or later.
3
What versions of WordPress are affected by CVE-2017-14723?
CVE-2017-14723 affects WordPress versions prior to 4.8.2.
4
Can CVE-2017-14723 be exploited by plugins?
Yes, CVE-2017-14723 can potentially be exploited by plugins that misuse the $wpdb->prepare function.
5
What types of attacks can CVE-2017-14723 facilitate?
CVE-2017-14723 can facilitate SQL injection attacks, potentially compromising the database and exposing sensitive data.