{"id":"CVE-2007-4154","aliases":["DEBIAN-CVE-2007-4154","DSA-1564-1","EUVD-2007-4138","GHSA-jhw4-989v-7prf"],"status":"published","title":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated...","description":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01899,"percentile":0.79805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2007-08-03T20:00:00Z","modified":"2026-10-21T17:47:45Z","fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["2.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["2.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["2.2.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1etch2"}]}],"versions":["2.0.10-1","2.0.10-1etch1","2.0.10-1~bpo.1","2.0.9-1"],"bundled":5}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35719","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://secunia.com/advisories/30013","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1564","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm/","tags":["x_refsource_MISC","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-4154"},{"url":"http://mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm"},{"url":"https://github.com/advisories/GHSA-jhw4-989v-7prf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2007-4154","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2007-4154","description":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.","status":"published","published":"2007-08-03T20:00:00Z","modified":"2024-08-07T14:46:39.302Z","updated_at":"2026-11-02T13:33:30.262137Z"}],"euvd":[{"id":"EUVD-2007-4138","description":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.","status":"published","published":"2007-08-03T20:00:00Z","modified":"2024-08-07T14:46:39Z","updated_at":"2026-11-03T01:16:22.95439Z"}],"ghsa":[{"id":"GHSA-jhw4-989v-7prf","title":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated...","description":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.","status":"published","published":"2022-05-01T18:20:44Z","modified":"2025-04-09T03:45:47Z","updated_at":"2026-11-02T15:00:55.004058Z"}],"nvd":[{"id":"CVE-2007-4154","description":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.","status":"published","published":"2007-08-03T20:17:00Z","modified":"2026-06-16T22:43:30.153Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:17.964611Z"}],"osv":[{"id":"CVE-2007-4154","description":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.","status":"published","published":"2007-08-03T20:17:00Z","modified":"2026-04-10T03:39:01.078941Z","updated_at":"2026-11-02T15:43:57.178433Z"},{"id":"DEBIAN-CVE-2007-4154","description":"SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.","status":"published","published":"2007-08-03T20:17:00Z","modified":"2026-10-21T17:47:45.726115198Z","updated_at":"2026-11-02T15:45:23.411908Z"},{"id":"DSA-1564-1","title":"wordpress - several vulnerabilities","status":"published","published":"2008-05-01T00:00:00Z","modified":"2026-03-09T01:01:49.133542Z","updated_at":"2026-11-02T15:46:14.734124Z"}]}}