WordPress Core 6.5.0 — 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export

Overview

Advisory ID

866f5121-81be-409e-b6d5-81b72bfb5539

Product

WordPress wordpress

Affected

≤7.1.2

Fixed in

6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

Weakness

CWE-89 SQL Injection

Required access

Unknown

Published

Oct 7, 2026 · updated Nov 13, 2026

Credit

Anthropic

WordPress Core is vulnerable to second-order SQL Injection in versions 6.5 through 7.1.2 because non-numeric values collected from post thumbnail metadata are concatenated into a later WXR export query. This makes it possible for authenticated attackers, with Author-level access and above and a separate method of storing a crafted _thumbnail_id value, to alter a database query when a privileged user subsequently performs an applicable single-content-type export. The default All content export does not reach the vulnerable branch.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.