CVE-2017-16510 — WordPress before 4

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-147

01What is this vulnerability?

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

02Affected products

No structured affected-product list available — see references below for vendor advisories.

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

08Timeline

• Published: 2017-11-02T16:29:00.787
• Last modified: 2026-05-13T00:24:29.033

09References

• www.securityfocus.com — http://www.securityfocus.com/bid/101638
• blog.ircmaxell.com — https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-techn…
• codex.wordpress.org — https://codex.wordpress.org/Version_4.8.3
• github.com — https://github.com/WordPress/WordPress/commit/a2693fd8602e3263b5925b9d799ddd5772…
• lists.debian.org — https://lists.debian.org/debian-lts-announce/2017/11/msg00003.html
• wordpress.org — https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/
• wpvulndb.com — https://wpvulndb.com/vulnerabilities/8941
• www.debian.org — https://www.debian.org/security/2018/dsa-4090
• www.securityfocus.com — http://www.securityfocus.com/bid/101638
• blog.ircmaxell.com — https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-techn…