$ cve CVE-2011-4899 JSON

CVE-2011-4899 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 9% (pctl 95)

Patch early

A public exploit exists.

Description

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	9.02% — more likely to be exploited than 95% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2012-01-30
Last modified	2026-06-16

Affected (1)

Vendor	Product
wordpress	wordpress

Public exploits

Source	Title	Date
exploit-db	WordPress Core 3.3.1 - Multiple Vulnerabilities	2012-01-25

References

→ the Explorer · watch your stack · NVD