CVEvulnerability

CVE-2017-9062

8.6 HIGH Published 2017-05-18 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2017-05-18
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.0 ([email protected]): 8.6 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses: CWE-352, CWE-601, CWE-79

Description

In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.

Affected configurations

• wordpress wordpress (<= 4.7.4) • debian debian linux 8.0 • debian debian linux 9.0

Related

Weakness · CWE (3)

CWE-352 Cross-Site Request Forgery weakness
CWE-601 URL Redirection to Untrusted Site weakness
CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

http://www.debian.org/security/2017/dsa-3870 Third Party Advisory
http://www.securityfocus.com/bid/98509 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038520 Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.7.5 Patch, Release Notes, Vendor Advisory
https://github.com/WordPress/WordPress/commit/3d95e3ae816f4d7c638f40d3e936a4be19724381 Patch, Third Party Advisory
https://wordpress.org/news/2017/05/wordpress-4-7-5/ Patch, Vendor Advisory
https://wpvulndb.com/vulnerabilities/8816 Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3870 Third Party Advisory
http://www.securityfocus.com/bid/98509 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038520 Third Party Advisory, VDB Entry
https://codex.wordpress.org/Version_4.7.5 Patch, Release Notes, Vendor Advisory
https://github.com/WordPress/WordPress/commit/3d95e3ae816f4d7c638f40d3e936a4be19724381 Patch, Third Party Advisory
https://wordpress.org/news/2017/05/wordpress-4-7-5/ Patch, Vendor Advisory
https://wpvulndb.com/vulnerabilities/8816 Patch, Third Party Advisory