The WXR export (Tools > Export) merges raw _thumbnail_id post meta values into a list of post IDs that is later interpolated unprepared into an SQL IN () clause. A lower-privileged user who can store a crafted _thumbnail_id value can get SQL executed when an administrator runs an export.
This vulnerability affects the following application versions:
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.5.8
- WordPress 6.5.9
- WordPress 6.5.10
- WordPress 6.5.11
- WordPress 6.5.12
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.6.5
- WordPress 6.6.6
- WordPress 6.6.7
- WordPress 6.6.8
- WordPress 6.6.9
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.7.8
- WordPress 6.7.9
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.8.9
- WordPress 6.8.10
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 6.9.8
- WordPress 6.9.9
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.0.5
- WordPress 7.0.6
- WordPress 7.1
- WordPress 7.1.1
- WordPress 7.1.2