p PatchFirst

CVE-2007-0233

CVE-2007-0233

This page contains facts from public vulnerability sources. Check the original advisory before updating.

wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.

EPSS 11.7% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • wordpress Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.1.0-1

    Update to 2.1.0-1

  • wordpress Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.1.0-1

    Update to 2.1.0-1

  • wordpress Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.1.0-1

    Update to 2.1.0-1

Original sources

Check your server →