CVE-2017-5611

Critical

Published: 30/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in class-wp-query.php in WP_Query in WordPress before version 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.

Risk Assessment

Attackers may gain access to the database, potentially leading to data theft or system compromise. Organizations should be aware of the risks associated with using vulnerable plugins or themes.

Recommendation

It is recommended to update WordPress to version 4.7.2 or later and to audit the used plugins and themes to identify and remove vulnerable components.

Original NVD description (English source)

SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.