Description
SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 3.0.2-1 | — |
| Debian 13 | wordpress | 3.0.2-1 | — |
| Debian 12 | wordpress | 3.0.2-1 | — |
| Debian 5.0 | wordpress | 2.5.1-11+lenny4 | DSA-2138-1 |
Advisories 1
- DSA-2138-1 wordpress - SQL injection Debian Security (DSA / DLA) · Mar 9, 2026
References
- 42844 third-party-advisory
- http://wordpress.org/news/2010/11/wordpress-3-0-2/
- DSA-2138 vendor-advisory
- FEDORA-2010-19329 vendor-advisory
- 42753 third-party-advisory
- http://blog.sjinks.pro/wordpress/858-information-disclosure-via-sql-injection-attack/
- FEDORA-2010-19290 vendor-advisory
- 42871 third-party-advisory
- ADV-2010-3337 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605603
- http://core.trac.wordpress.org/changeset/16625
- http://www.xakep.ru/magazine/xa/124/052/1.asp
- 45131 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=659265
- FEDORA-2010-19296 vendor-advisory
- FEDORA-2010-19330 vendor-advisory
- 42431 third-party-advisory
- http://codex.wordpress.org/Version_3.0.2
- ADV-2011-0042 vdb-entry
- ADV-2011-0057 vdb-entry