CVE-2007-4893: wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not...

Security readout for executives and security teams

This old WordPress issue lets a remote attacker inject script content by abusing how WordPress checked the unfiltered_html privilege when posts or pages were modified. The business risk is mainly legacy exposure: any still-running WordPress before 2.2.3 or WordPress MU before 1.2.5a should be treated as unsafe. Exposure is likely limited to very old WordPress or WordPress MU deployments, forks, appliances, or archived sites that still run pre-2.2.3 or pre-1.2.5a code. Current WordPress installations are not identified as affected by the provided sources. Prioritize this if legacy WordPress exists in production, on public archives, or inside acquired environments. For modern WordPress estates, this is mainly a historical hygiene and asset-discovery issue rather than an emergency, because active exploitation is not evidenced in the provided sources. Mitigation focus: Upgrade WordPress to 2.2.3 or later.; Upgrade WordPress MU to 1.2.5a or later.; Check vendor guidance for any backported distribution packages..

Prepared

Jun 29, 2026, 03:38 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.