CVE-2007-4894

CVE-2007-4894 describes multiple SQL injection vulnerabilities in WordPress versions prior to 2.2.3 and WordPress Multi-User (MU) prior to 1.2.5a. These flaws allow remote attackers to execute arbitrary SQL commands, primarily through the post_type parameter in the XMLRPC interface's getPingbacks method, as well as other unspecified parameters due to insufficient database escaping and validation. With a CVSS score of 7.5, this vulnerability is considered highly severe, enabling unauthenticated attackers to achieve partial confidentiality, integrity, and availability impacts with low attack complexity. Despite its age and severity, there is no evidence of active exploitation, publicly available exploit code in common frameworks like Metasploit or ExploitDB, nor significant community discussion or media coverage.