Is CVE-2017-5611 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5611 being exploited in the wild.

How severe is CVE-2017-5611?

Critical severity, with a CVSS score of 9.8, published 30 January 2017.

Is there a fix for CVE-2017-5611?

A patch was published on 2017-01-26: WordPress 4.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5611 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-5611?

Check whether you run Wordpress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5611: WordPress WP_Query SQL injection in post type handling

CVE-2017-5611 · Severity: critical · CVSS 9.8 · Published 2017-01-30

A vulnerability in the core WordPress query engine could allow attackers to execute unauthorized database commands. While WordPress itself is not directly exploitable in its default state, this flaw allows third-party plugins and themes to inadvertently expose the site to SQL injection attacks. If exploited, an attacker could potentially access sensitive user data, modify site content, or gain full control over the website's database.

Technologies: Wordpress. Vendors: Wordpress.

Quick answers

Is CVE-2017-5611 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5611 being exploited in the wild.
How severe is CVE-2017-5611?: Critical severity, with a CVSS score of 9.8, published 30 January 2017.
Which products and versions are affected?: Wordpress < 4.7.2.
Is there a fix for CVE-2017-5611?: A patch was published on 2017-01-26: WordPress 4.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5611 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-5611?: Check whether you run Wordpress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the WP_Query class within wp-includes/class-wp-query.php. The root cause is the improper neutralization of special characters in post type names when constructing SQL queries. While WordPress core does not expose a direct path to exploit this, third-party plugins or themes that pass unvalidated user input into WP_Query parameters (specifically post types) can be leveraged by remote attackers to execute arbitrary SQL commands. The fix, introduced in version 4.7.2, implements hardening by using esc_sql() and $wpdb->prepare() to ensure post type parameters are properly escaped before being included in database queries.

Affected products

WordPress WordPress < 4.7.2

Timeline

2017-01-26: patched: WordPress 4.7.2 released
2017-01-30: disclosed: Public disclosure of CVE-2017-5611

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.