UpHeron
All vulnerabilities

WordPress core

CVE-2007-0233

wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the…

Severity
High 7.5
Published
13 Jan 2007
Last changed
16 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Version 2.0.6
  • Version 2.0.5
  • Version 2.0.4
  • Version 2.0.3
All 19 release lines
  • Version 0.6.2-beta_2
  • Version 0.6.2.1-beta_2
  • Version 0.7
  • Version 0.71
  • Version 1.2
  • Version 1.2.1
  • Version 1.2.2
  • Version 1.5
  • Version 1.5.1
  • Version 1.5.1.2
  • Version 1.5.1.3
  • Version 1.5.2
  • Version 2.0
  • Version 2.0.1
  • Version 2.0.2
  • Version 2.0.3
  • Version 2.0.4
  • Version 2.0.5
  • Version 2.0.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2007-0233
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2007-0233