CVE-2022-21661highobserved exploitationCWE-89

SQL injection in WordPress

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8epss 98%

from disclosure to weapon12 days

Published on NVDJan 6

1st PoC+12d

VulnCheck+716d

exploitation probability

98%top 1% of all CVEs

observed exploitation

yesVulnCheck

27 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Not affected

1 product — because the vulnerable code is not present in the product

red_hat_products

In short

WordPress has a SQL injection vulnerability in WP_Query where improperly sanitized input can allow attackers to execute unauthorized database commands through vulnerable plugins or themes. This flaw affects multiple WordPress versions and requires updating to patch the issue.

Technical detail

CWE-89 SQL injection in WP_Query stemming from insufficient input sanitization allows attackers to inject malicious SQL code through plugins or themes that utilize WP_Query without proper parameterization. The vulnerability requires an attacker to exploit a vulnerable plugin or theme, and successful exploitation enables unauthorized database access and manipulation. Patched in WordPress 5.8.3 and earlier versions back to 3.7.37.

Summary generated and translated by AI from the official description.

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

WordPress · wordpress-develop

public PoCs found — 27

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84 https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/https://www.debian.org/security/2022/dsa-5039 https://www.exploit-db.com/exploits/50663 https://www.vicarius.io/vsociety/posts/understanding-the-wordpress-sql-injection-vulnerability-cve-2022-21661 https://www.zerodayinitiative.com/advisories/ZDI-22-020/