SQL Injection Affecting johnpbloch/wordpress-core package, versions >=3.8.1, <3.8.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-JOHNPBLOCHWORDPRESSCORE-8648606
- published21 Jan 2025
- disclosed9 Apr 2014
- creditTom Adams
Introduced: 9 Apr 2014
CVE NOT AVAILABLE CWE-89 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade johnpbloch/wordpress-core to version 3.8.2 or higher.
Overview
johnpbloch/wordpress-core is a web software you can use to create a website or blog.
Affected versions of this package are vulnerable to SQL Injection due to the links_recently_updated_time parameter. An attacker can manipulate SQL queries and potentially access or alter data without proper authorization by injecting malicious SQL code.
Note:
This is only exploitable if the user has administrative privileges.