A significant SQL-Injection vulnerability has been fixed in WordPress 4.8.3. The vulnerability was reported via Hacker-One on September 20th, 2017. The post will detail the technical vulnerability as well as how to mitigate it. There is another post which deals with the background and time-lines. To prevent this issue? Nothing, its been mitigated at the WP layer. That should be enough to prevent these sorts of issues. In general, go through and remove all user input from the $query side of ->prepare().”]
Source: https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-technical.html