CVE-2017-14723

Critical

Published: 23/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, potentially allowing SQL injection attacks via plugins and themes.

Risk Assessment

Organizations may be exposed to SQL injection attacks, which could lead to unauthorized access and modification of data.

Recommendation

It is recommended to update WordPress to version 4.8.2 or later to mitigate this vulnerability.

Original NVD description (English source)

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.