If you experience any issues with your installation, or if you want to check if you're running a patched version of WordPress, you can do so by visiting the Settings > General menu and checking the WordPress version. If it's below 4.1.34, then your installation is affected by this issue. WordPress version 4.1.34 and below are vulnerable to SQL Injection. WordPress version 4.2.1 and below are vulnerable to XSS Injection. WordPress version 4.3.1 and below are vulnerable to Remote Code Execution. WordPress version 4.4.1 and below are vulnerable to Credential Stuffing. In addition to the above, WordPress versions 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.5.7, 4.5.8, 4.5.9, 4.5.10, 4.5.11, 4.5.12, 4.5.13, 4.5.14, 4.5.15, 4.5.16, 4.5.17, 4.5.18, 4.5.19, 4.5.20, 4.5.21, 4.5.22, 4.5.23, 4.5.24, 4.5.25, 4.5.26, 4.5.27, 4.
How do I check if WordPress is vulnerable?
If you are curious about if your WordPress installation is affected, you can check the version number of your WordPress installation.
WordPress version 4.1.34 and below are vulnerable to SQL Injection
WordPress version 4.2.1 and below are vulnerable to XSS Injection
WordPress version 4.3.1 and below are vulnerable to Remote Code Execution
WordPress version 4.4.1 and below are vulnerable to Credential Stuffing
Installation of WordPress code
The installation page for WordPress includes a warning at the end when you're asked to download and install the code.
The warning says that the code has been tested to work on "WordPress 4.1.34+ with PHP 5.2+." If you're unsure if your installation is vulnerable, search for this phrase in your installation's source code.
If you find any occurrences of this phrase, click the "X" next to them to delete them.
SQL injection occurs when input is sent to a database that then executes commands inserted by the attacker. The most common method for SQL injection is when an application passes user input to a MySQL database without encoding special characters.