# CVE-2017-5611: WordPress WP_Query SQL injection in post type handling

Source: https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-30. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5611 · Severity: critical · CVSS 9.8 · Published 2017-01-30

A vulnerability in the core WordPress query engine could allow attackers to execute unauthorized database commands. While WordPress itself is not directly exploitable in its default state, this flaw allows third-party plugins and themes to inadvertently expose the site to SQL injection attacks. If exploited, an attacker could potentially access sensitive user data, modify site content, or gain full control over the website's database.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2017-5611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5611 being exploited in the wild.

**How severe is CVE-2017-5611?** Critical severity, with a CVSS score of 9.8, published 30 January 2017.

**Which products and versions are affected?** Wordpress < 4.7.2.

**Is there a fix for CVE-2017-5611?** A patch was published on 2017-01-26: WordPress 4.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5611 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-5611?** Check whether you run Wordpress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the WP_Query class within wp-includes/class-wp-query.php. The root cause is the improper neutralization of special characters in post type names when constructing SQL queries. While WordPress core does not expose a direct path to exploit this, third-party plugins or themes that pass unvalidated user input into WP_Query parameters (specifically post types) can be leveraged by remote attackers to execute arbitrary SQL commands. The fix, introduced in version 4.7.2, implements hardening by using esc_sql() and $wpdb->prepare() to ensure post type parameters are properly escaped before being included in database queries.

## Affected products

- WordPress WordPress < 4.7.2

## Timeline

- 2017-01-26: patched: WordPress 4.7.2 released
- 2017-01-30: disclosed: Public disclosure of CVE-2017-5611

## References

- [http://www.debian.org/security/2017/dsa-3779](http://www.debian.org/security/2017/dsa-3779)
- [http://www.openwall.com/lists/oss-security/2017/01/28/5](http://www.openwall.com/lists/oss-security/2017/01/28/5)
- [http://www.securityfocus.com/bid/95816](http://www.securityfocus.com/bid/95816)
- [http://www.securitytracker.com/id/1037731](http://www.securitytracker.com/id/1037731)
- [https://codex.wordpress.org/Version_4.7.2](https://codex.wordpress.org/Version_4.7.2)
- [https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb](https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb)
- [https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/](https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress Press This information exposure in taxonomy UI](https://junglewise.ai/threats/cve-2017-5610-wordpress-press-this-information-exposure-in-taxonomy-ui)