hitoshura25/cvefixes huggingface dataset:
CVE-2016-6635 (PHP, published 2016-08-07T16:59Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/ajax-actions.php
wp-admin/includes/template.php
wp-includes/version.php
Commit message: Add nonce to AJAX action for script compression setting

Built from https://develop.svn.wordpress.org/trunk@37143


git-svn-id: http://core.svn.wordpress.org/trunk@37110 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
				x.open('GET', ajaxurl + '?action=wp-compression-test&test='+test+'&'+(new Date()).getTime(), true);
$wp_version = '4.5-RC1-37135';

Fixed code:
			check_ajax_referer( 'update_can_compress_scripts' );
			check_ajax_referer( 'update_can_compress_scripts' );
	var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ) ); ?>;
				x.open('GET', ajaxurl + '?action=wp-compression-test&test='+test+'&_ajax_nonce='+compressionNonce+'&'+(new Date()).getTime(), true);
$wp_version = '4.5-RC1-37143';
CVE-2016-7168 (PHP, published 2017-01-05T02:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/media.php
wp-includes/version.php
Commit message: Media: Sanitize upload filename.

Built from https://develop.svn.wordpress.org/trunk@38538


git-svn-id: http://core.svn.wordpress.org/trunk@38481 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
	$title = $basename;
$wp_version = '4.7-alpha-38536';

Fixed code:
	$title = sanitize_title( $basename );
$wp_version = '4.7-alpha-38538';
CVE-2016-7169 (PHP, published 2017-01-05T02:59Z)
Description: value: Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.
Severity: MEDIUM (CVSS v3 base score: 6.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/class-file-upload-upgrader.php
wp-includes/version.php
Commit message: Upgrade/Install: Sanitize file name in `File_Upload_Upgrader`.
Built from https://develop.svn.wordpress.org/trunk@38524


git-svn-id: http://core.svn.wordpress.org/trunk@38465 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			$this->filename = $_GET[$urlholder];
$wp_version = '4.7-alpha-38523';

Fixed code:
			$this->filename = sanitize_file_name( $_GET[ $urlholder ] );

			if ( 0 !== strpos( realpath( $this->package ), realpath( $uploads['basedir'] ) ) ) {
				wp_die( __( 'Please select a file' ) );
			}
$wp_version = '4.7-alpha-38524';
CVE-2017-14723 (PHP, published 2017-09-23T20:29Z)
Description: value: Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/version.php
wp-includes/wp-db.php
Commit message: Database: Hardening to bring `wpdb::prepare()` inline with documentation.

`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.


Built from https://develop.svn.wordpress.org/trunk@41496


git-svn-id: http://core.svn.wordpress.org/trunk@41329 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.9-alpha-41483';
						$queries[ $col ] = $this->prepare( "CONVERT( LEFT( CONVERT( %s USING $charset ), %.0f ) USING $connection_charset )", $value['value'], $value['length']['length'] );

Fixed code:
$wp_version = '4.9-alpha-41496';
		$query = preg_replace( '/%(?:%|$|([^dsF]))/', '%%\\1', $query ); // escape any unescaped percents 
						$length = sprintf( '%.0f', $value['length']['length'] );
						$queries[ $col ] = $this->prepare( "CONVERT( LEFT( CONVERT( %s USING $charset ), $length ) USING $connection_charset )", $value['value'] );
CVE-2017-14723 (PHP, published 2017-09-23T20:29Z)
Description: value: Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/version.php
wp-includes/wp-db.php
Commit message: Database: Hardening for `wpdb::prepare()`

Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.


Built from https://develop.svn.wordpress.org/trunk@41470


git-svn-id: http://core.svn.wordpress.org/trunk@41303 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.9-alpha-41457';
		if ( isset( $args[0] ) && is_array($args[0]) )

Fixed code:
$wp_version = '4.9-alpha-41470';

		if ( is_array( $args[0] ) && count( $args ) == 1 ) {
		}

		foreach ( $args as $arg ) {
			if ( ! is_scalar( $arg ) ) {
				_doing_it_wrong( 'wpdb::prepare', sprintf( __( 'Unsupported value type (%s).' ), gettype( $arg ) ), '4.8.2' );
			}
		}
CVE-2017-17091 (PHP, published 2017-12-02T06:29Z)
Description: value: wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/user-new.php
wp-includes/version.php
Commit message: Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring.

Built from https://develop.svn.wordpress.org/trunk@42258


git-svn-id: http://core.svn.wordpress.org/trunk@42087 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			$newuser_key = substr( md5( $user_id ), 0, 5 );
$wp_version = '5.0-alpha-42257';

Fixed code:
			$newuser_key = wp_generate_password( 20, false );
$wp_version = '5.0-alpha-42258';
CVE-2017-17092 (PHP, published 2017-12-02T06:29Z)
Description: value: wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/functions.php
wp-includes/version.php
Commit message: Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.

Built from https://develop.svn.wordpress.org/trunk@42261


git-svn-id: http://core.svn.wordpress.org/trunk@42090 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
	if ( empty( $unfiltered ) )
		unset( $t['htm|html'] );
$wp_version = '5.0-alpha-42260';

Fixed code:
	if ( empty( $unfiltered ) ) {
		unset( $t['htm|html'], $t['js'] );
	}
$wp_version = '5.0-alpha-42261';
CVE-2017-17093 (PHP, published 2017-12-02T06:29Z)
Description: value: wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/general-template.php
wp-includes/version.php
Commit message: Hardening: Add escaping to the language attributes used on `html` elements.

Built from https://develop.svn.wordpress.org/trunk@42259


git-svn-id: http://core.svn.wordpress.org/trunk@42088 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
	if ( $lang = get_bloginfo('language') ) {
		if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
			$attributes[] = "lang=\"$lang\"";
		if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
			$attributes[] = "xml:lang=\"$lang\"";
$wp_version = '5.0-alpha-42258';

Fixed code:
	if ( $lang = get_bloginfo( 'language' ) ) {
		if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
			$attributes[] = 'lang="' . esc_attr( $lang ) . '"';
		}
		if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
			$attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
		}
$wp_version = '5.0-alpha-42259';
CVE-2017-17094 (PHP, published 2017-12-02T06:29Z)
Description: value: wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/feed.php
wp-includes/version.php
Commit message: Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.

Built from https://develop.svn.wordpress.org/trunk@42260


git-svn-id: http://core.svn.wordpress.org/trunk@42089 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
				echo apply_filters( 'rss_enclosure', '<enclosure url="' . trim( htmlspecialchars( $enclosure[0] ) ) . '" length="' . trim( $enclosure[1] ) . '" type="' . $type . '" />' . "\n" );
				echo apply_filters( 'atom_enclosure', '<link href="' . trim( htmlspecialchars( $enclosure[0] ) ) . '" rel="enclosure" length="' . trim( $enclosure[1] ) . '" type="' . trim( $enclosure[2] ) . '" />' . "\n" );
$wp_version = '5.0-alpha-42259';

Fixed code:
				echo apply_filters( 'rss_enclosure', '<enclosure url="' . esc_url( trim( $enclosure[0] ) ) . '" length="' . absint( trim( $enclosure[1] ) ) . '" type="' . esc_attr( $type ) . '" />' . "\n" );
				echo apply_filters( 'atom_enclosure', '<link href="' . esc_url( trim( $enclosure[0] ) ) . '" rel="enclosure" length="' . absint( trim( $enclosure[1] ) ) . '" type="' . esc_attr( trim( $enclosure[2] ) ) . '" />' . "\n" );
$wp_version = '5.0-alpha-42260';
CVE-2017-5487 (PHP, published 2017-01-15T02:59Z)
Description: value: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php
wp-includes/version.php
Commit message: REST API: Change which users are shown in the users endpoint.

Only show users that have authored a post of a post type that has `show_in_rest` set to true.

Props rachelbaker, jnylen0.
See #38878.


Built from https://develop.svn.wordpress.org/trunk@39843


git-svn-id: http://core.svn.wordpress.org/trunk@39781 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			$prepared_args['has_published_posts'] = true;
$wp_version = '4.8-alpha-39831';

Fixed code:
			$prepared_args['has_published_posts'] = get_post_types( array( 'show_in_rest' => true ), 'names' );
$wp_version = '4.8-alpha-39843';
CVE-2017-5488 (PHP, published 2017-01-15T02:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/update-core.php
wp-includes/version.php
Commit message: Updates: Translate plugin data on the Updates screen.
Built from https://develop.svn.wordpress.org/trunk@39808


git-svn-id: http://core.svn.wordpress.org/trunk@39746 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-alpha-39807';

Fixed code:
		$plugin_data = (object) _get_plugin_data_markup_translate( $plugin_file, (array) $plugin_data, false, true );

$wp_version = '4.8-alpha-39808';
CVE-2017-5490 (PHP, published 2017-01-15T02:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/class-wp-theme.php
wp-includes/version.php
Commit message: Themes: Fix markup for theme name fallbacks.
Built from https://develop.svn.wordpress.org/trunk@39807


git-svn-id: http://core.svn.wordpress.org/trunk@39745 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
				if ( empty( $value ) )
					$value = $this->get_stylesheet();
$wp_version = '4.8-alpha-39795';

Fixed code:
				if ( empty( $value ) ) {
					$value = esc_html( $this->get_stylesheet() );
				}
$wp_version = '4.8-alpha-39807';
CVE-2017-5491 (PHP, published 2017-01-15T02:59Z)
Description: value: wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1188 \u2014 Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/version.php
wp-mail.php
Commit message: Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com.

Built from https://develop.svn.wordpress.org/trunk@39772


git-svn-id: http://core.svn.wordpress.org/trunk@39710 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-alpha-39760';

Fixed code:
$wp_version = '4.8-alpha-39772';
$mailserver_url = get_option( 'mailserver_url' );

if ( 'mail.example.com' === $mailserver_url || empty( $mailserver_url ) ) {
	wp_die( __( 'This action has been disabled by the administrator.' ), 403 );
}
CVE-2017-5492 (PHP, published 2017-01-15T02:59Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/class-wp-screen.php
wp-admin/widgets.php
wp-includes/version.php
Commit message: Add nonce for widget accessibility mode.

Props vortfu.

See #23328.


Built from https://develop.svn.wordpress.org/trunk@39760


git-svn-id: http://core.svn.wordpress.org/trunk@39698 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off">' . __('Disable accessibility mode') . "</a></p>\n";
$wp_version = '4.8-alpha-39759';

Fixed code:
				$nonce = wp_create_nonce( 'widgets-access' );
				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on&_wpnonce=' . urlencode( $nonce ) . '">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off&_wpnonce=' . urlencode( $nonce ) . '">' . __('Disable accessibility mode') . "</a></p>\n";
	check_admin_referer( 'widgets-access' );

$wp_version = '4.8-alpha-39760';
CVE-2017-5493 (PHP, published 2017-01-15T02:59Z)
Description: value: wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-338 \u2014 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/ms-functions.php
wp-includes/version.php
Commit message: Multisite: Use `wp_rand()` in signup key creation.

Built from https://develop.svn.wordpress.org/trunk@39795


git-svn-id: http://core.svn.wordpress.org/trunk@39733 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
	$key = substr( md5( time() . rand() . $domain ), 0, 16 );
	$key = substr( md5( time() . rand() . $user_email ), 0, 16 );
$wp_version = '4.8-alpha-39772';

Fixed code:
	$key = substr( md5( time() . wp_rand() . $domain ), 0, 16 );
	$key = substr( md5( time() . wp_rand() . $user_email ), 0, 16 );
$wp_version = '4.8-alpha-39795';
CVE-2017-5611 (PHP, published 2017-01-30T04:59Z)
Description: value: SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/class-wp-query.php
wp-includes/version.php
Commit message: Query: Ensure that queries work correctly with post type names with special characters.
Built from https://develop.svn.wordpress.org/trunk@39952


git-svn-id: http://core.svn.wordpress.org/trunk@39889 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
				$where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", $in_search_post_types ) . "')";
			$where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", $post_type) . "')";
			$where .= " AND {$wpdb->posts}.post_type = '$post_type'";
$wp_version = '4.8-alpha-39951';

Fixed code:
				$where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
			$where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')";
			$where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
$wp_version = '4.8-alpha-39952';