CVE-2017-5611: Debian Linux

Critical severity, CVSS 9.8. EPSS: 9.9% chance of exploitation in the next 30 days.

SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Oracle Data Integrator: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
• WordPress WordPress: up to and including 4.7.1

Published 2017-01-30. Last modified 2026-06-17.