CVE-2006-1012: WordPress

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.

Affected products

• WordPress WordPress: version 1.5.2 only

Published 2006-03-06. Last modified 2026-06-16.