CVE-2017-1001000

🗓️ 03 Apr 2017 01:00:00Reported by joshbressersType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 197 Views🌐 WEB

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, allowing remote attackers to modify arbitrary pages

Reporter	Title	Published	Views	Family All 28
Circl	CVE-2017-1001000	29 May 201815:50	–	circl
Cvelist	CVE-2017-1001000	3 Apr 201701:00	–	cvelist
Debian CVE	CVE-2017-1001000	3 Apr 201701:00	–	debiancve
Nmap	http-vuln-cve2017-1001000 NSE Script	1 Jun 201719:08	–	nmap
NVD	CVE-2017-1001000	3 Apr 201701:59	–	nvd
OpenVAS	WordPress < 4.7.2 Multiple Security Vulnerabilities - Linux	2 Feb 201700:00	–	openvas
OpenVAS	WordPress < 4.7.2 Multiple Security Vulnerabilities - Windows	2 Feb 201700:00	–	openvas
OSV	DEBIAN-CVE-2017-1001000	3 Apr 201701:59	–	osv
Prion	Integer overflow	3 Apr 201701:59	–	prion
SonarSource Blog	Cachet 2.4: Code Execution via Laravel Configuration Injection	21 Sep 202100:00	–	sonarsource

NVD

Node

wordpress wordpressMatch4.7

wordpress wordpressMatch4.7.1

wordpress wordpressMatch4.7.2

Source	Link
securitytracker	www.securitytracker.com/id/1037731
openwall	www.openwall.com/lists/oss-security/2017/02/10/16
github	www.github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7
gist	www.gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab
make	www.make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/
codex	www.codex.wordpress.org/Version_4.7.2
blogs	www.blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html
wordpress	www.wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
blog	www.blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html

Parameter	Position	Path	Description	CWE
id	path	wp-json/wp/v2/posts/123	REST API post id validation flaw could allow modification when non-numeric suffix is used in query (example: wp-json/wp/v2/posts/123?id=123helloworld).

13 May 2026 00:24Current

8.3High risk

Vulners AI Score8.3

CVSS 25

CVSS 37.5

EPSS0.78934