CVE-2022-21661

Home/CVE/WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to

CVE

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3.

Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.

HIGH · CVSS 8 EPSS 0.90365

Act now

EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
EPSS percentile: top 0% of all CVEs by exploitation likelihood
Public exploit or PoC is available
CVSS base score ≥ 7.0

Sigma rules0 YARA rules0

⬡

Weakness Classification

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

▤

Affected Products & Versions

wordpress>= 3.7 and < 3.7.37
wordpress>= 3.8 and < 3.8.37
wordpress>= 3.9 and < 3.9.35
wordpress>= 4.0 and < 4.0.34
wordpress>= 4.1 and < 4.1.34
wordpress>= 4.2 and < 4.2.31
wordpress>= 4.3 and < 4.3.27
wordpress>= 4.4 and < 4.4.26
Show all 24 affected productswordpress>= 4.5 and < 4.5.25
wordpress>= 4.6 and < 4.6.22
wordpress>= 4.7 and < 4.7.22
wordpress>= 4.8 and < 4.8.18
wordpress>= 4.9 and < 4.9.19
wordpress>= 5.0 and < 5.0.15
wordpress>= 5.1 and < 5.1.12
wordpress>= 5.2 and < 5.2.14
wordpress>= 5.3 and < 5.3.11
wordpress>= 5.4 and < 5.4.9
wordpress>= 5.5 and < 5.5.8
wordpress>= 5.6 and < 5.6.7
wordpress>= 5.7 and < 5.7.5
wordpress>= 5.8 and < 5.8.3
fedoraproject fedoraall versions
debian linuxall versions

⚠

Public Exploits & PoCs

webappsWordPress Core 5.8.2 - 'WP_Query' SQL Injection2022-01-13
nucleiWordPress <5.8.3 - SQL Injectionhigh
pocpacketstormsecurity.com · WordPress-Core-5.8.2-SQL-Injection.htmlpacketstormsecurity.com
pocwww.exploit-db.com · 50663www.exploit-db.com
pocwww.vicarius.io · understanding-the-wordpress-sql-injection-vulnerability-c...www.vicarius.io