CVE-2007-0107

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

• http://osvdb.org/31579
• http://secunia.com/advisories/23595Patch, Vendor Advisory
• http://secunia.com/advisories/23741
• http://security.gentoo.org/glsa/glsa-200701-10.xml
• http://securityreason.com/securityalert/2112
• http://wordpress.org/development/2007/01/wordpress-206/Patch
• http://www.hardened-php.net/advisory_022007.141.htmlPatch, Vendor Advisory
• http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/archive/1/456049/100/0/threaded
• http://www.securityfocus.com/bid/21907Exploit, Patch
• http://www.vupen.com/english/advisories/2007/0061
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31297
• http://osvdb.org/31579
• http://secunia.com/advisories/23595Patch, Vendor Advisory
• http://secunia.com/advisories/23741
• http://security.gentoo.org/glsa/glsa-200701-10.xml
• http://securityreason.com/securityalert/2112
• http://wordpress.org/development/2007/01/wordpress-206/Patch
• http://www.hardened-php.net/advisory_022007.141.htmlPatch, Vendor Advisory
• http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/archive/1/456049/100/0/threaded
• http://www.securityfocus.com/bid/21907Exploit, Patch
• http://www.vupen.com/english/advisories/2007/0061
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31297

Published

Jan 9, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-0101Cross-site request forgery (CSRF) vulnerability in SPINE all…
• CVE-2007-0102The Adobe PDF specification 1.3, as implemented by Apple Mac…
• CVE-2007-0103The Adobe PDF specification 1.3, as implemented by Adobe Acr…
• CVE-2007-0104The Adobe PDF specification 1.3, as implemented by (a) xpdf …
• CVE-2007-0105Stack-based buffer overflow in the CSAdmin service in Cisco …
• CVE-2007-0106Cross-site scripting (XSS) vulnerability in the CSRF protect…
• CVE-2007-0108nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/200…
• CVE-2007-0109wp-login.php in WordPress 2.0.5 and earlier displays differe…
• CVE-2007-0110Cross-site scripting (XSS) vulnerability in nidp/idff/sso in…
• CVE-2007-0111Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and …
• CVE-2007-0112SQL injection vulnerability in cats.asp in createauction all…
• CVE-2007-0113Buffer overflow in Packeteer PacketShaper PacketWise 8.x all…