Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-1000217: Zotpress plugin lets attackers run database commands

CVE-2016-1000217 · published 10 years ago

Summary

The Zotpress add‑on for WordPress can be tricked into executing unauthorized database queries. This could let a malicious user view, change, or delete data stored by the plugin. Update the plugin to the latest version or remove it if a fix is not available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
zotpress_project	zotpress	<= 6.1.2 `cpe:2.3:a:zotpress_project:zotpress::::::wordpress::*`

Original advisory text

Zotpress plugin for WordPress SQLi in zp_get_account()

References

http://www.securityfocus.com/bid/93894 Third Party Advisory VDB Entry
https://wordpress.org/plugins/zotpress/changelog/ Release Notes
https://wordpress.org/support/topic/sql-injection-in-api_user_id/ Exploit Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

6% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published6 Oct 2016

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2016-1000217 · NVD

Track software like this

Free during beta