CVE-2007-0107

The record

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

Affected packages

Related vulnerabilities

• CVE-2023-2745 WordPress Core is vulnerable to Directory Traversal in versions up to, and including… Also affects wordpress
• CVE-2010-0682 WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from… Also affects wordpress
• CVE-2008-7220 Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2… Also affects wordpress
• CVE-2009-2762 wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password… Also affects wordpress
• CVE-2009-2335 WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login… Also affects wordpress
• CVE-2008-5695 wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does… Also affects wordpress
• CVE-2007-0233 wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when… Also affects wordpress
• CVE-2006-4208 Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for… Also affects wordpress