kbrain

CVE-2011-4899

HIGH · CVSS 7.5EPSS 9.0%EU EUVD

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments

Key facts

CVSS score
7.5 (v2.0)
Severity
HIGH
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS score
9.0% (95th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2011-4816)
Published
January 30, 2012
NVD last modified
November 3, 2026
Status
Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2011-4816 in the EU Vulnerability Database. Last updated in EUVD on November 3, 2026.

View on the EU Vulnerability Database

Affected products

  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress
  • wordpress / wordpress

and 23 more…

References

Last updated November 5, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain