WaratekVRT Sign in

CVE-2017-5611 WordPress

Affected softwareWordPress
Severity9.8 Critical CVSS 3.1 2 scores
WeaknessSQL injection (CWE-89)
Published30 Jan 2017
Updated17 Jun 2026

Description

SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2022-01-26.
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 10% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-5611 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation ic3.gov /Media/News/2022/220126.pdf 2022-01-26

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Products and versions

3 products, 6 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 8.0 · 9.0
nvd oracle data integrator generic 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0
nvd wordpress wordpress generic ≤ 4.7.1

References

URLTags
http://www.debian.org/security/2017/dsa-3779 Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/28/5 Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95816 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037731 Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.7.2 Release Notes, Vendor Advisory
https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb Patch, Third Party Advisory
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ Patch, Vendor Advisory
https://wpvulndb.com/vulnerabilities/8730 Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory

Timeline
Published2017-01-30By the CVE Program.
VulnCheck KEV: earliest evidence2022-01-26Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.