CVE-2017-14723: WordPress

Critical severity, CVSS 9.8. EPSS: 6.5% chance of exploitation in the next 30 days.

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.

Affected products

• WordPress WordPress: up to and including 4.8.1

Published 2017-09-23. Last modified 2026-06-17.