Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2017-1001000
Deferred
More InfoOfficial Page
Source-46fe6300-5254-4a98-9594-a9567bec8179
View Known Exploited Vulnerability (KEV) details
Published At-03 Apr, 2017 | 01:59
Updated At-20 Apr, 2025 | 01:37

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.07.5HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary2.05.0MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
Type: Primary
Version: 3.0
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Type: Primary
Version: 2.0
Base score: 5.0
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
CPE Matches
WordPress.org
wordpress
>>wordpress>>4.7
cpe:2.3:a:wordpress:wordpress:4.7:*:*:*:*:*:*:*
WordPress.org
wordpress
>>wordpress>>4.7.1
cpe:2.3:a:wordpress:wordpress:4.7.1:*:*:*:*:*:*:*
WordPress.org
wordpress
>>wordpress>>4.7.2
cpe:2.3:a:wordpress:wordpress:4.7.2:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
NVD-CWE-noinfoPrimarynvd@nist.gov
CWE ID: NVD-CWE-noinfo
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://www.openwall.com/lists/oss-security/2017/02/10/1646fe6300-5254-4a98-9594-a9567bec8179
N/A
http://www.securitytracker.com/id/103773146fe6300-5254-4a98-9594-a9567bec8179
N/A
https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html46fe6300-5254-4a98-9594-a9567bec8179
N/A
https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html46fe6300-5254-4a98-9594-a9567bec8179
N/A
https://codex.wordpress.org/Version_4.7.246fe6300-5254-4a98-9594-a9567bec8179
N/A
https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab46fe6300-5254-4a98-9594-a9567bec8179
N/A
https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f746fe6300-5254-4a98-9594-a9567bec8179
N/A
https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/46fe6300-5254-4a98-9594-a9567bec8179
N/A
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/46fe6300-5254-4a98-9594-a9567bec8179
N/A
http://www.openwall.com/lists/oss-security/2017/02/10/16af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.securitytracker.com/id/1037731af854a3a-2127-422b-91ae-364da2661108
N/A
https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://codex.wordpress.org/Version_4.7.2af854a3a-2127-422b-91ae-364da2661108
N/A
https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762abaf854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7af854a3a-2127-422b-91ae-364da2661108
N/A
https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/af854a3a-2127-422b-91ae-364da2661108
N/A
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/af854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2017/02/10/16
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: http://www.securitytracker.com/id/1037731
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: https://codex.wordpress.org/Version_4.7.2
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
Source: 46fe6300-5254-4a98-9594-a9567bec8179
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2017/02/10/16
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.securitytracker.com/id/1037731
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://codex.wordpress.org/Version_4.7.2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Change History
0Changes found
Details not found