• Home
  • About Us
  • Authors
  • Submit News
  • Contact Us
  • Privacy Policy
  • Sitemap
The Hack Post
  • Hacking News
    • Cyber Crime
  • Cyber Security
  • Technology
    • Internet
  • Entertainment
    • Gaming
  • Business
  • Science / Health
No Result
View All Result
The Hack Post
No Result
View All Result

WordPress < 4.8.3 Vulnerable To SQL Injection (SQLI) Exploit

Haider Ali Khan by Haider Ali Khan
November 1, 2017
WordPress SQL Injection
Share on FacebookShare on Twitter

A security researcher named “Anthony Ferrara” has found a critical SQL Injection (SQLI) vulnerability in the WordPress CMS. According to WordPress team, the vulnerability exists in all previous versions of the CMS, Whereas the vulnerability has been patched in the latest WordPress version 4.8.3 released which was released yesterday. Therefore, WordPress has strongly encouraged all it’s CMS users to upgrade their scripts to the latest version as soon as possible.

WordPress reported that the issue comes from $wpdb->prepare(), which can create unexpected and unsafe queries leading to an SQL Injection (SQLI). WordPress team have said that the vulnerability is not in the core script, but can be caused by plugins and themes using $wpdb->prepare(). WordPress had been made changes to the esc_sql() function to prevent SQL Injection queries, However the changes wont have any effects on WordPress developers.

The vulnerability founder, Anthony Ferrara shared a story on his blog on how he got WordPress team to pay attention to the bug reported. Although WordPress had literally ignored the bug, thinking it wasn’t a vulnerability. After Anthony Ferrara asked permission for disclosing the vulnerability to the public, WordPress team decided to have another look into the reported vulnerability, which then was found to be a serious flaw.

The vulnerability was originally found on 19th September 2017, which then was reported to WordPress on 20th September 2017. On 27 October 2017, Anthony Ferrara shared a tweet on Facebook regarding him disclosing the SQL Injection vulnerability in WordPress soon.

IMPORTANT: I will be disclosing a massive WP SQLi vulnerability soon. I have no confidence WP will fix correctly and hence no choice but FD

— Anthony Ferrara (@ircmaxell) October 26, 2017

That being said, On 31st October 2017, Anthony Ferrara published an article on his blog on how the vulnerability works, what code causes the CMS to break and how to fix the buggy code in steps. WordPress also thanked Anthony Ferrara for reporting the vulnerability and for practicing responsible disclosure.

Back in February, WordPress was vulnerable to a REST API exploit which had lead to thousands of websites being hacked and defaced. As the new SQL Injection vulnerability has just been disclosed to the public, we hope it won’t result in the same outcome as it did with the REST API vulnerability.

Tags: SQL InjectionWordpress
Haider Ali Khan

Haider Ali Khan

Founder, content creator and writer of The Hack Post. I am an independent cyber security researcher and ethical hacker. I am passionate and committed to educating the world to spread information and expose the threats that exist online. I have a vast span of knowledge and experience in the field of hacking and I’m here to share it all with everyone else.

Next Post
Hacked By Team Bad Dream

Ministry of Foreign Affairs and 20 Embassy Websites of Lebanon Hacked

Latest Articles

Playing With Power Thrills On Four Wheels
Entertainment

Playing With Power: Thrills On Four Wheels

November 28, 2023
The Role of IoT in Facilities Management: A Deep Dive into Smart Operational Workflow Solutions
Business

The Role of IoT in Facilities Management: A Deep Dive into Smart Operational Workflow Solutions

November 28, 2023
TV Shows That Have Earned Prestigious Awards
Entertainment

TV Shows That Have Earned Prestigious Awards

November 27, 2023
Building Excellence Top Fabrication Materials in Construction
Business

Building Excellence: Top Fabrication Materials in Construction

November 27, 2023
Securing Your Investment How Is Physical Gold Delivered?
Business

Securing Your Investment: How Is Physical Gold Delivered?

November 27, 2023
5 Reasons to Study Law
news

5 Reasons to Study Law

November 27, 2023
3 Times When You Need to Use a Video Measuring Machine
Technology

3 Times When You Need to Use a Video Measuring Machine

November 24, 2023
What We Can Learn from Automation in the Home Industry
Technology

What We Can Learn from Automation in the Home Industry

November 23, 2023
Key Things to Think About When Changing Your Engine
news

Key Things to Think About When Changing Your Engine

November 20, 2023
End of the Road What to Do with a Dead Car - Exploring Your Options
news

End of the Road: What to Do with a Dead Car – Exploring Your Options

November 18, 2023
Unraveling the Differences Between Shrimp and Prawn
Science / Health

Unraveling the Differences Between Shrimp and Prawn

November 18, 2023
Becoming a Game Developer Essential Requirements and Key Skills for Success
Technology

Becoming a Game Developer: Essential Requirements and Key Skills for Success

November 18, 2023
  • Home
  • About Us
  • Authors
  • Submit News
  • Contact Us
  • Privacy Policy
  • Sitemap

The Hack Post © 2019

No Result
View All Result
  • Hacking News
    • Cyber Crime
  • Cyber Security
  • Technology
    • Internet
  • Entertainment
    • Gaming
  • Business
  • Science / Health

The Hack Post © 2019