High
Security advisory
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-1001000
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:25 UTC · Revision 1
Source evidence
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
osv:CVE-2017-1001000
Complete source record
{
"id": "5b8d80231a3e59c3cfc1475ba3d495d5796781fd9be1894fac155de043f71d90",
"url": "https://osv.dev/vulnerability/CVE-2017-1001000",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-1001000",
"summary": "The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.",
"evidence": "osv:CVE-2017-1001000",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-1001000",
"aliases": [
"CVE-2017-1001000"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wordpress/wordpress",
"type": "GIT",
"events": [
{
"introduced": "14247ee4302378d292863865c643abe99bbfe3c7"
},
{
"last_affected": "1ea8e9a4f03f425a6a77c3487528fedd3f33c100"
},
{
"fixed": "e357195ce303017d517aff944644a7a1232926f7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wordpress:wordpress:4.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7"
},
{
"last_affected": "4.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:4.7.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7.1"
},
{
"last_affected": "4.7.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:4.7.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7.2"
},
{
"last_affected": "4.7.2"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "e357195ce303017d517aff944644a7a1232926f7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.7",
"4.7.1",
"4.7.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1001000.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/wordpress/wordpress-develop",
"type": "GIT",
"events": [
{
"introduced": "efa83f48bd4ebd066e5efc94b9feefe50e7925a2"
},
{
"last_affected": "c0ad47cca62d55072d8a4d1b24d97224bc568349"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wordpress:wordpress:4.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7"
},
{
"last_affected": "4.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:4.7.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7.1"
},
{
"last_affected": "4.7.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:4.7.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7.2"
},
{
"last_affected": "4.7.2"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.7",
"4.7.1",
"4.7.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1001000.json"
}
}
],
"modified": "2026-10-24T10:47:23.179761311Z",
"provider": "osv",
"references": [
"https://codex.wordpress.org/Version_4.7.2",
"https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab",
"https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/",
"https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/",
"https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7",
"https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html",
"https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-1001000",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 441177,
"published_at": "2017-04-03T01:59:00.227+00:00"
}