Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xpem-wnea-x3ct
Vulnerability ID VCID-xpem-wnea-x3ct
Aliases CVE-2007-3140
Summary SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.02571 https://api.first.org/data/v1/epss?cve=CVE-2007-3140
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2007-3140
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3140
428073 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=428073
OSVDB-36321;CVE-2007-3140 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/4039.txt
Data source Exploit-DB
Date added June 5, 2007
Description WordPress Core 2.2 - 'xmlrpc.php' SQL Injection
Ransomware campaign use Known
Source publication date June 6, 2007
Exploit type webapps
Platform php
Source update date Oct. 5, 2016
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.85796
EPSS Score 0.02571
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T13:40:49.611629+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0