CVE-2015-2292

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress...

6.5 MediumPublic exploit

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

Exploit likelihood

5.61%Up 3.8 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2015-2292
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-2292
Updated: 2026-11-02

EUVDEUVD-2015-2390 No score

Record: EUVD-2015-2390
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fp7j-jm6r-w2qr No score

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress...

Record: GHSA-fp7j-jm6r-w2qr
Weakness: CWE-89
Updated: 2026-11-02

Affected products

yoast wordpress seo

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection	2015-03-16

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-2292 is a medium vulnerability (CVSS 6.5) in Yoast Wordpress Seo, published March 17, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.61%, the 92nd percentile. No source names a fixed version.