ZDI-CAN-15541: WordPress Core WP_Query SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WPQuery class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Frequently Asked Questions
What is the severity of ZDI-CAN-15541?
The severity of ZDI-CAN-15541 is considered high due to its potential to disclose sensitive information without authentication.
How do I fix ZDI-CAN-15541?
You can fix ZDI-CAN-15541 by updating your WordPress Core to the latest version that addresses the vulnerability.
What types of installations are affected by ZDI-CAN-15541?
ZDI-CAN-15541 affects all installations of WordPress Core that have not been updated to the patched version.
Can ZDI-CAN-15541 be exploited remotely?
Yes, ZDI-CAN-15541 can be exploited remotely by attackers without requiring authentication.
What component of WordPress is vulnerable in ZDI-CAN-15541?
The vulnerability in ZDI-CAN-15541 exists specifically within the WP_Query class of WordPress Core.