CVE-2010-4257

MEDIUM 6.0CVE-2010-4257 · Published 07/12/2010 · updated 16/06/2026

Package	Affected versions	Patched versions
wordpress wordpress	`≤ 3.0.1`	No fix yet

Description

SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.

References

blog.sjinks.pro/wordpress/858-information-disclosure-via-sql-injection-attack · Broken Link
bugs.debian.org/cgi-bin/bugreport.cgi · Issue Tracking
codex.wordpress.org/Version_3.0.2 · Vendor Advisory
core.trac.wordpress.org/changeset/16625 · Vendor Advisory
lists.fedoraproject.org/pipermail/package-announce/2011-January/052879.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2011-January/052892.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2011-January/052917.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2011-January/052932.html · Third Party Advisory
secunia.com/advisories/42431 · Third Party Advisory
secunia.com/advisories/42753 · Third Party Advisory
secunia.com/advisories/42844 · Third Party Advisory
secunia.com/advisories/42871 · Third Party Advisory
wordpress.org/news/2010/11/wordpress-3-0-2 · Patch
debian.org/security/2010/dsa-2138 · Third Party Advisory
securityfocus.com/bid/45131 · Third Party Advisory
vupen.com/english/advisories/2010/3337 · Third Party Advisory
vupen.com/english/advisories/2011/0042 · Third Party Advisory
vupen.com/english/advisories/2011/0057 · Third Party Advisory
xakep.ru/magazine/xa/124/052/1.asp · Not Applicable
bugzilla.redhat.com/show_bug.cgi · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free