A potential SQL injection that could be used to compromise a site FIX: trunk/src/wp-includes/post.php foreach ( $group_by_status as $status => $comments ) { // Sanity check. This shouldn't happen. - if ( 'post-trashed' == $status ) + if ( 'post-trashed' == $status ) { $status = '0'; - $comments_in = implode( "', '", $comments ); - $wpdb->query( "UPDATE $wpdb->comments SET comment_approved = '$status' WHERE comment_ID IN ('" . $comments_in . "')" ); + } + $comments_in = implode( ', ', array_map( 'intval', $comments ) ); + $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->comments SET comment_approved = %s WHERE comment_ID IN ($comments_in)", $status ) ); }