Executive brief
A vulnerability in the core WordPress query engine could allow attackers to execute unauthorized database commands. While WordPress itself is not directly exploitable in its default state, this flaw allows third-party plugins and themes to inadvertently expose the site to SQL injection attacks. If exploited, an attacker could potentially access sensitive user data, modify site content, or gain full control over the website's database.
Technical details
A SQL injection vulnerability exists in the WP_Query class within wp-includes/class-wp-query.php. The root cause is the improper neutralization of special characters in post type names when constructing SQL queries. While WordPress core does not expose a direct path to exploit this, third-party plugins or themes that pass unvalidated user input into WP_Query parameters (specifically post types) can be leveraged by remote attackers to execute arbitrary SQL commands. The fix, introduced in version 4.7.2, implements hardening by using esc_sql() and $wpdb->prepare() to ensure post type parameters are properly escaped before being included in database queries.
Affected products
- WordPress WordPress < 4.7.2
Timeline
- 2017-01-26: patched: WordPress 4.7.2 released
- 2017-01-30: disclosed: Public disclosure of CVE-2017-5611
References
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/28/5
- http://www.securityfocus.com/bid/95816
- http://www.securitytracker.com/id/1037731
- https://codex.wordpress.org/Version_4.7.2
- https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb
- https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/