CVE-2007-4894: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user MU before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the posttype parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters...

wordpress -- remote sql injection vulnerability

Alexander Concha reports: While testing WordPress, it has been discovered a SQL Injection vulnerability that allows an attacker to retrieve remotely any user credentials from a vulnerable site, this bug is caused because of early database escaping and the lack of validation in query string like...