Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
@batuhan @HSVSphere next.js is running tiktok, netflix and twitch, so not sure what your argument is supposed to be here. WordPress itself also had some horrible security issues (CVE-2017-1001000, CVE-2019-8942)
Post summary
The tweet notes that WordPress had CVE-2017-1001000 and CVE-2019-8942 but gives no technical details, PoC, patch, or exploitation evidence.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wordpress | wordpress | 4.7 | - | - |
| App | wordpress | wordpress | 4.7.1 | - | - |
| App | wordpress | wordpress | 4.7.2 | - | - |