blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-21661

HIGH 7.5 CVSS 3.1
Published
January 6, 2022
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security-advisories@github.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.

Affected WordPress components

  • WordPress core
    Confirmed match
    From 3.9 (including) to 3.9.35 (excluding); From 4.0 (including) to 4.0.34 (excluding); From 3.7 (including) to 3.7.37 (excluding); From 3.8 (including) to 3.8.37 (excluding); From 4.1 (including) to 4.1.34 (excluding); From 4.2 (including) to 4.2.31 (excluding); From 4.3 (including) to 4.3.27 (excluding); From 4.4 (including) to 4.4.26 (excluding); From 4.5 (including) to 4.5.25 (excluding); From 4.6 (including) to 4.6.22 (excluding); From 4.7 (including) to 4.7.22 (excluding); From 4.8 (including) to 4.8.18 (excluding); From 4.9 (including) to 4.9.19 (excluding); From 5.0 (including) to 5.0.15 (excluding); From 5.1 (including) to 5.1.12 (excluding); From 5.2 (including) to 5.2.14 (excluding); From 5.3 (including) to 5.3.11 (excluding); From 5.4 (including) to 5.4.9 (excluding); From 5.5 (including) to 5.5.8 (excluding); From 5.6 (including) to 5.6.7 (excluding); From 5.7 (including) to 5.7.5 (excluding); From 5.8 (including) to 5.8.3 (excluding)

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • WordPress wordpress-develop — Version < 5.8.3
  • wordpress wordpress — From 3.7 (including) to 3.7.37 (excluding)
  • wordpress wordpress — From 3.8 (including) to 3.8.37 (excluding)
  • wordpress wordpress — From 3.9 (including) to 3.9.35 (excluding)
  • wordpress wordpress — From 4.0 (including) to 4.0.34 (excluding)
  • wordpress wordpress — From 4.1 (including) to 4.1.34 (excluding)
  • wordpress wordpress — From 4.2 (including) to 4.2.31 (excluding)
  • wordpress wordpress — From 4.3 (including) to 4.3.27 (excluding)
  • wordpress wordpress — From 4.4 (including) to 4.4.26 (excluding)
  • wordpress wordpress — From 4.5 (including) to 4.5.25 (excluding)
  • wordpress wordpress — From 4.6 (including) to 4.6.22 (excluding)
  • wordpress wordpress — From 4.7 (including) to 4.7.22 (excluding)
  • wordpress wordpress — From 4.8 (including) to 4.8.18 (excluding)
  • wordpress wordpress — From 4.9 (including) to 4.9.19 (excluding)
  • wordpress wordpress — From 5.0 (including) to 5.0.15 (excluding)
  • wordpress wordpress — From 5.1 (including) to 5.1.12 (excluding)
  • wordpress wordpress — From 5.2 (including) to 5.2.14 (excluding)
  • wordpress wordpress — From 5.3 (including) to 5.3.11 (excluding)
  • wordpress wordpress — From 5.4 (including) to 5.4.9 (excluding)
  • wordpress wordpress — From 5.5 (including) to 5.5.8 (excluding)
  • wordpress wordpress — From 5.6 (including) to 5.6.7 (excluding)
  • wordpress wordpress — From 5.7 (including) to 5.7.5 (excluding)
  • wordpress wordpress — From 5.8 (including) to 5.8.3 (excluding)

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
  • github.com https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214 Patch, Third Party Advisory
  • github.com https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84 Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/ Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/ Third Party Advisory
  • wordpress.org https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/ Release Notes, Vendor Advisory
  • www.debian.org https://www.debian.org/security/2022/dsa-5039 Third Party Advisory
  • www.exploit-db.com https://www.exploit-db.com/exploits/50663 Exploit, Third Party Advisory, VDB Entry
  • www.zerodayinitiative.com https://www.zerodayinitiative.com/advisories/ZDI-22-020/ Third Party Advisory, VDB Entry
  • www.vicarius.io https://www.vicarius.io/vsociety/posts/understanding-the-wordpress-sql-injection-vulnerability-cve-2022-21661 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record