CVE-2011-4899

CVE-2011-4899 affects WordPress 3.3.1 and earlier, specifically within the wp-admin/setup-config.php installation component. It allows remote attackers to specify an arbitrary MySQL database via the dbhost and dbname parameters, leading to static code injection and cross-site scripting (XSS) attacks through HTTP requests or MySQL queries. This vulnerability has a CVSS score of 7.5, indicating high severity with a network attack vector and low attack complexity, requiring no authentication. Successful exploitation could result in partial compromise of confidentiality, integrity, and availability. The vendor disputes the significance, but remote code execution makes it critical in many environments. While there is no evidence of active exploitation (KEV: No), an ExploitDB entry (EDB-18417) exists, suggesting publicly available exploit code. There is minimal community discussion or media coverage, which is typical for a large percentage of CVEs.