Every CVE Search/ Get API key

CVE-2017-16510

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and...

9.8 CriticalFix available

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.70%Up 4.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Record
CVE-2017-16510
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-89
Updated
2026-11-02
CVE List No score

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Record
CVE-2017-16510
Updated
2026-11-02
EUVDEUVD-2017-7704 No score

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Record
EUVD-2017-7704
Updated
2026-11-03
GitHub AdvisoriesGHSA-4cxp-jjp3-3qpw 9.8

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and...

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Record
GHSA-4cxp-jjp3-3qpw
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV 9.8

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Record
CVE-2017-16510
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-16510 9.8

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Record
DEBIAN-CVE-2017-16510
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-16510 9.8

WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

Record
UBUNTU-CVE-2017-16510
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wordpress
Debian:12
 before 4.8.3+dfsg-1
4.8.3+dfsg-1
wordpress
Debian:13
 before 4.8.3+dfsg-1
4.8.3+dfsg-1
wordpress
Debian:14
 before 4.8.3+dfsg-1
4.8.3+dfsg-1
wordpress
Debian:7
 before 3.6.1+dfsg-1~deb7u18, plus listed versions
3.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-1
Show 25 moreShow less
3.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u63.6.1+dfsg-1~deb6u73.6.1+dfsg-1~deb6u83.6.1+dfsg-1~deb6u93.6.1+dfsg-1~deb7u13.6.1+dfsg-1~deb7u103.6.1+dfsg-1~deb7u113.6.1+dfsg-1~deb7u123.6.1+dfsg-1~deb7u133.6.1+dfsg-1~deb7u143.6.1+dfsg-1~deb7u153.6.1+dfsg-1~deb7u163.6.1+dfsg-1~deb7u173.6.1+dfsg-1~deb7u23.6.1+dfsg-1~deb7u33.6.1+dfsg-1~deb7u43.6.1+dfsg-1~deb7u53.6.1+dfsg-1~deb7u63.6.1+dfsg-1~deb7u83.6.1+dfsg-1~deb7u9
3.6.1+dfsg-1~deb7u18
wordpress
Debian:8
From an advisory covering 5 CVEs
 before 4.1+dfsg-1+deb8u16, plus listed versions
4.1+dfsg-14.1+dfsg-1+deb8u14.1+dfsg-1+deb8u104.1+dfsg-1+deb8u114.1+dfsg-1+deb8u12
Show 11 moreShow less
4.1+dfsg-1+deb8u134.1+dfsg-1+deb8u144.1+dfsg-1+deb8u154.1+dfsg-1+deb8u24.1+dfsg-1+deb8u34.1+dfsg-1+deb8u44.1+dfsg-1+deb8u54.1+dfsg-1+deb8u64.1+dfsg-1+deb8u74.1+dfsg-1+deb8u84.1+dfsg-1+deb8u9
4.1+dfsg-1+deb8u16
wordpress
Debian:9
From an advisory covering 5 CVEs
 before 4.7.5+dfsg-2+deb9u2, plus listed versions
4.7.5+dfsg-24.7.5+dfsg-2+deb9u14.7.5+dfsg-2+deb9u1~bpo8+14.7.5+dfsg-2+deb9u2~bpo8+1
4.7.5+dfsg-2+deb9u2
wordpress
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-16510 is a critical vulnerability (CVSS 9.8) in Wordpress, published November 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.70%, the 93rd percentile. Fixed in wordpress 4.8.3+dfsg-1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open