CVE-2017-16510

Critical

Published: 02/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

WordPress versions before 4.8.3 are affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries, leading to potential SQL injection (SQLi) in plugins and themes.

Risk Assessment

Organizations may be exposed to SQL injection attacks, which could lead to unauthorized access to or modification of data.

Recommendation

It is recommended to update WordPress to version 4.8.3 or later to mitigate this vulnerability.

Original NVD description (English source)

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.