CVE-2017-1001000

🗓️ 03 Apr 2017 01:00:00Reported by joshbressersType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 305 Views🌐 WEB

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, allowing remote attackers to modify arbitrary pages

Reporter	Title	Published	Views	Family All 32
Circl	CVE-2017-1001000	29 May 201815:50	–	circl
Cvelist	CVE-2017-1001000	3 Apr 201701:00	–	cvelist
Debian CVE	CVE-2017-1001000	3 Apr 201701:00	–	debiancve
Mend	CVE-2017-1001000	3 Apr 201701:00	–	mend
Metasploit	WordPress REST API Content Injection	1 Feb 201700:00	–	metasploit
Nmap	http-vuln-cve2017-1001000 NSE Script	1 Jun 201719:08	–	nmap
NVD	CVE-2017-1001000	3 Apr 201701:59	–	nvd
OpenVAS	WordPress < 4.7.2 Multiple Security Vulnerabilities - Linux	2 Feb 201700:00	–	openvas
OpenVAS	WordPress < 4.7.2 Multiple Security Vulnerabilities - Windows	2 Feb 201700:00	–	openvas
osv_debian	DEBIAN-CVE-2017-1001000	3 Apr 201701:59	–	osv_debian

NVD

Node

wordpress wordpressMatch4.7

wordpress wordpressMatch4.7.1

wordpress wordpressMatch4.7.2

Source	Link
securitytracker	www.securitytracker.com/id/1037731
openwall	www.openwall.com/lists/oss-security/2017/02/10/16
github	www.github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7
gist	www.gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab
make	www.make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/
codex	www.codex.wordpress.org/Version_4.7.2
blogs	www.blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html
wordpress	www.wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
blog	www.blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html

Parameter	Position	Path	Description	CWE
id	path	/wp-json/wp/v2/posts/123?id=123helloworld	Type juggling in the REST API allows remote attackers to modify arbitrary pages by providing a numeric value followed by a non-numeric value in the path and a query parameter.	CWE-287
per_page	query param	/wp-json/wp/v2/posts	The REST API endpoints for posts are accessible and may be subject to content injection via type juggling in vulnerable WordPress versions.	CWE-287
search	query param	/wp-json/wp/v2/posts	The REST API endpoints for posts are accessible and may be subject to content injection via type juggling in vulnerable WordPress versions.	CWE-287
id	request body	/wp-json/wp/v2/posts	Content injection via type juggling in the REST API allows modification of post data.	CWE-287
title	request body	/wp-json/wp/v2/posts	Content injection via type juggling in the REST API allows modification of post data.	CWE-287
content	request body	/wp-json/wp/v2/posts	Content injection via type juggling in the REST API allows modification of post data.	CWE-287
password	request body	/wp-json/wp/v2/posts	Content injection via type juggling in the REST API allows modification of post data.	CWE-287

17 Jun 2026 00:59Current

8.3High risk

Vulners AI Score8.3

CVSS 25

CVSS 37.5

EPSS0.84935

In Wild