CVE-2011-4899
** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and...
CVE-2011-4899 is a high vulnerability (CVSS 7.5) in Wordpress, published January 30, 2012. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.02%, the 95th percentile.
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
Exploit likelihood
What each source reports
NVD Score used
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
- Record
CVE-2011-4899- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-03
CVE List No score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
- Record
CVE-2011-4899- Updated
- 2026-11-03
EUVDEUVD-2011-4816 No score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
- Record
EUVD-2011-4816- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-75qw-xjcp-vvmv No score
** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and...
** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments.
- Record
GHSA-75qw-xjcp-vvmv- Updated
- 2026-11-02
OSV No score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
- Record
CVE-2011-4899- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4899 No score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments
- Record
DEBIAN-CVE-2011-4899- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
All versions, plus listed versions 6.1.1+dfsg1-16.1.6+dfsg1-0+deb12u16.1.9+dfsg1-0+deb12u16.2+dfsg1-16.2.1+dfsg1-1 Show 26 moreShow less6.2.2+dfsg1-16.3+dfsg1-16.3.1+dfsg1-16.3.2+dfsg1-16.4.1+dfsg1-16.4.1+dfsg1-1.16.4.2+dfsg1-16.4.3+dfsg1-16.5+dfsg1-16.5.2+dfsg1-16.5.3+dfsg1-16.5.5+dfsg1-16.6.1+dfsg1-16.7.2+dfsg1-16.7.2+dfsg1-1.16.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
wordpressDebian:13 |
All versions, plus listed versions 6.8.1+dfsg1-16.8.10+dfsg1-0+deb13u16.8.3+dfsg1-0+deb13u16.8.3+dfsg1-16.8.6+dfsg1-0+deb13u1 Show 10 moreShow less6.8.7+dfsg1-0+deb13u16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
wordpressDebian:14 |
All versions, plus listed versions 6.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-1 Show 6 moreShow less7.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Core 3.3.1 - Multiple Vulnerabilities | 2012-01-25 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | facts | CVE List |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |