CVE-2017-1001000
HighExploitedThe register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts…
Published Apr 3, 2017 · Updated Aug 4, 2026 · Also known as 2481f37b-a220-435d-9b43-6e7c5f42034f, DEBIAN-CVE-2017-1001000
Key Facts
Patch immediately- CVE-2017-1001000 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Wordpress.
- It is exploited in the wild, listed in Industry KEV feed since Jun 2, 2021. No public exploit code is known.
- EPSS estimates a 85% probability of exploitation in the next 30 days.
- Fixed versions are available, including Wordpress 3.7.18, Wordpress 4.7.2+dfsg-1.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (30-day exploit likelihood)
85%
Higher than 99.7% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing
Public exploit code
None known
Get the full CVE-2017-1001000 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Jun 2, 2021 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
15 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| WordpressWordpress | 4.7, 4.7.1, 4.7.2, >= 3.7 | 4.7.2+dfsg-1 |
Patched Releases
Wordpress
3.7.18, 4.7.2+dfsg-1
Timeline
Publicly disclosed
Apr 3, 2017
Added to Industry KEV feed
Jun 2, 2021
Last updated
Aug 4, 2026
Weakness Type
- CWE-285 Improper Authorization
References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2017-1001000
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/2481f37b-a220-435d-9b43-6e7c5f42034f?source=api-prod
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/2481f37b-a220-435d-9b43-6e7c5f42034f?source=api-scan
- exploitVulnCheck exploitation report
- otherhttps://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html
FAQ
Common Questions.
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-n…
Affected: Wordpress versions 4.7, 4.7.1, 4.7.2, >= 3.7. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Jun 2, 2021.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Wordpress 3.7.18, Wordpress 4.7.2+dfsg-1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2017-1001000 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo