CVE-2017-1001000
Description
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Official description from the CVE record, published by joshbressers. Copyright © 1999-2026 The MITRE Corporation. See /security/cve/legal for the CVE license. View the record on cve.org
Key data
EPSS
- Score
- 0.84935 (84.9% probability)
- Percentile
- 99.7%
- Scores of
- Nov 10, 2026
- Model
- v2026.06.15
References
- codex.wordpress.org/Version_4.7.2
- make.wordpress.org/core/2017/02/01/disclosure-of-additional…
- blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.ht…
- gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab
- blog.sucuri.net/2017/02/content-injection-vulnerability-wor…
- github.com/WordPress/WordPress/commit/e357195ce303017d517af…
- wordpress.org/news/2017/01/wordpress-4-7-2-security-release
- [oss-security] 20170210 Re: Asking for a CVE id for the WordPress Privilege Escalation vulnerability (4.7/4.7.1) (openwall.com)mailing-list
- 1037731 (securitytracker.com)vdb-entry
Timeline
- ID reserved
- Record published
- Record last updated
Look up another CVE
About CubePath
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 19:49 UTC. Sources and licenses