• Home
  • About Us
  • Authors
  • Submit News
  • Contact Us
  • Privacy Policy
  • Sitemap
The Hack Post
  • Hacking News
    • Cyber Crime
  • Cyber Security
  • Technology
    • Internet
  • Entertainment
    • Gaming
  • Business
  • Science / Health
No Result
View All Result
The Hack Post
No Result
View All Result

WordPress < 4.8.3 Vulnerable To SQL Injection (SQLI) Exploit

Haider Ali Khan by Haider Ali Khan
November 1, 2017
WordPress SQL Injection
Share on FacebookShare on Twitter

A security researcher named “Anthony Ferrara” has found a critical SQL Injection (SQLI) vulnerability in the WordPress CMS. According to WordPress team, the vulnerability exists in all previous versions of the CMS, Whereas the vulnerability has been patched in the latest WordPress version 4.8.3 released which was released yesterday. Therefore, WordPress has strongly encouraged all it’s CMS users to upgrade their scripts to the latest version as soon as possible.

WordPress reported that the issue comes from $wpdb->prepare(), which can create unexpected and unsafe queries leading to an SQL Injection (SQLI). WordPress team have said that the vulnerability is not in the core script, but can be caused by plugins and themes using $wpdb->prepare(). WordPress had been made changes to the esc_sql() function to prevent SQL Injection queries, However the changes wont have any effects on WordPress developers.

The vulnerability founder, Anthony Ferrara shared a story on his blog on how he got WordPress team to pay attention to the bug reported. Although WordPress had literally ignored the bug, thinking it wasn’t a vulnerability. After Anthony Ferrara asked permission for disclosing the vulnerability to the public, WordPress team decided to have another look into the reported vulnerability, which then was found to be a serious flaw.

The vulnerability was originally found on 19th September 2017, which then was reported to WordPress on 20th September 2017. On 27 October 2017, Anthony Ferrara shared a tweet on Facebook regarding him disclosing the SQL Injection vulnerability in WordPress soon.

IMPORTANT: I will be disclosing a massive WP SQLi vulnerability soon. I have no confidence WP will fix correctly and hence no choice but FD

— Anthony Ferrara (@ircmaxell) October 26, 2017

That being said, On 31st October 2017, Anthony Ferrara published an article on his blog on how the vulnerability works, what code causes the CMS to break and how to fix the buggy code in steps. WordPress also thanked Anthony Ferrara for reporting the vulnerability and for practicing responsible disclosure.

Back in February, WordPress was vulnerable to a REST API exploit which had lead to thousands of websites being hacked and defaced. As the new SQL Injection vulnerability has just been disclosed to the public, we hope it won’t result in the same outcome as it did with the REST API vulnerability.

Tags: SQL InjectionWordpress
Haider Ali Khan

Haider Ali Khan

Founder, content creator and writer of The Hack Post. I am an independent cyber security researcher and ethical hacker. I am passionate and committed to educating the world to spread information and expose the threats that exist online. I have a vast span of knowledge and experience in the field of hacking and I’m here to share it all with everyone else.

Next Post
Hacked By Team Bad Dream

Ministry of Foreign Affairs and 20 Embassy Websites of Lebanon Hacked

Latest Articles

10 Improvements Your Tech Business Should Make Next Year
Business

10 Improvements Your Tech Business Should Make Next Year

July 1, 2022
How To Create An Anonymous Account In Any Online App
Technology

How To Create An Anonymous Account In Any Online App

June 30, 2022
4 Tips for a Successful Digital Marketing Campaign
Technology

4 Tips for a Successful Digital Marketing Campaign

June 29, 2022
How to Recruit Top Software Developer Talent Online
Technology

How to Recruit Top Software Developer Talent Online

June 28, 2022
A Quick Introduction to Holographic Vinyl
Business

A Quick Introduction to Holographic Vinyl

June 27, 2022
7 Things To Know Before Moving To Seattle, WA
Business

7 Things To Know Before Moving To Seattle, WA

June 27, 2022
Why You Need a VPN on Your Smartphone
Technology

Why You Need a VPN on Your Smartphone

June 27, 2022
6 Useful Tips To Improve Your Copywriting
Technology

6 Useful Tips To Improve Your Copywriting

June 24, 2022
The Guide You Need To Lose Weight in 2022
Science / Health

The Guide You Need To Lose Weight in 2022

June 24, 2022
Top Natural Supplements for Weight Loss You Need to Try in 2022
Science / Health

Top Natural Supplements for Weight Loss You Need to Try in 2022

June 24, 2022
How To Manage Your Health And Wellness With A Hectic Work Life
Business

How To Manage Your Health And Wellness With A Hectic Work Life

June 24, 2022
Health and Safety Considerations When Designing A New Office
Business

Health and Safety Considerations When Designing A New Office

June 24, 2022
  • Home
  • About Us
  • Authors
  • Submit News
  • Contact Us
  • Privacy Policy
  • Sitemap

The Hack Post © 2019

No Result
View All Result
  • Hacking News
    • Cyber Crime
  • Cyber Security
  • Technology
    • Internet
  • Entertainment
    • Gaming
  • Business
  • Science / Health

The Hack Post © 2019