Abel Cheung

**Name of the Vulnerable Software and Affected Versions** WordPress versions 2.3.1 and earlier **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the `s` parameter in `wp-includes/query.php`, specifically when `DB CHARSET` is set to certain character set encodings such as Big5 or GBK, which support a "" in a multibyte character. **Recommendations** For WordPress versions 2.3.1 and earlier, update to a version later than 2.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the `s` parameter in the affected query to minimize the risk of exploitation.