Vulnerability record · CVE-2017-1001000 · published 3 April 2017
CVE-2017-1001000: WordPress REST API content injection via non-integer post ID
Wordpress · Wordpress
The REST API posts controller in WordPress 4.7.x before 4.7.2 fails to require an integer identifier, so a request such as wp-json/wp/v2/posts/123?id=123helloworld can bypass the intended post lookup. This lets an unauthenticated remote attacker modify the content of arbitrary existing posts.
Description
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Automated analysis
high priorityUnauthenticated remote content modification with a very high EPSS score and public exploit details, though it does not expose data or enable code execution.
What it is
The REST API posts controller in WordPress 4.7.x before 4.7.2 fails to require an integer identifier, so a request such as wp-json/wp/v2/posts/123?id=123helloworld can bypass the intended post lookup. This lets an unauthenticated remote attacker modify the content of arbitrary existing posts.
Impact
An attacker can alter the title or body of any post on a vulnerable site, enabling content injection, defacement, or planting of malicious links and payloads.
Attack surface
Reachable over the network through the public WordPress REST API endpoint wp-json/wp/v2/posts; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.84935, 99.7th percentile) and public references include technical write-ups and a proof-of-concept gist, indicating widespread exploitation activity.
What to do
- Upgrade WordPress to 4.7.2 or later, which fixes the REST API identifier handling.
- If immediate upgrade is not possible, disable or restrict access to the REST API (e.g., block wp-json/wp/v2/posts requests at the WAF or web server).
- Review and restore any posts whose content or titles were unexpectedly changed.
- Monitor WordPress core release notes and apply future security updates promptly.
Detection
- Search web server and WAF logs for requests to wp-json/wp/v2/posts/ with a numeric path segment followed by a non-numeric id parameter value.
- Alert on POST or PUT requests to wp-json/wp/v2/posts endpoints from unauthenticated clients.
- Audit post revision history for unexpected content changes originating from REST API requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-1001000 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-1001000), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
