CVE-2007-6318: WordPress

Medium severity, CVSS 6.8. EPSS: 9.2% chance of exploitation in the next 30 days.

SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DB_CHARSET is set to (1) Big5, (2) GBK, or possibly other character set encodings that support a "\" in a multibyte character.

Affected products

• WordPress WordPress: version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; …

Published 2007-12-12. Last modified 2026-06-16.