CVE-2017-5611

CVE-2017-5611 is a critical SQL injection vulnerability affecting WordPress versions prior to 4.7.2, specifically within the wp-includes/class-wp-query.php component. This flaw allows remote attackers to execute arbitrary SQL commands if a vulnerable plugin or theme mishandles a crafted post type name. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no known public exploit code or active exploitation listed in KEV, the vulnerability has garnered significant community discussion and media coverage, including mentions in reports on potential Iranian cyber operations.