CVE-2022-21661

high-risk

Published 2022-01-06

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.

Do I need to act?

90.9% chance of exploitation in next 30 days

EPSS score — higher than 9% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

50663

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.0/10 High

NETWORK / HIGH complexity

Affected Products (6)

Wordpress

Fedora

Debian Linux

Affected Vendors

Debian Wordpress Fedoraproject

References (21)

Exploit http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.h...

Patch https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3...

Third Party Advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqf...

Mailing List https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html

Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Release Notes https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/

Third Party Advisory https://www.debian.org/security/2022/dsa-5039

Exploit https://www.exploit-db.com/exploits/50663

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-22-020/

Exploit http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.h...

Patch https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3...

Third Party Advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqf...

Mailing List https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html

Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Release Notes https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/

Third Party Advisory https://www.debian.org/security/2022/dsa-5039

Exploit https://www.exploit-db.com/exploits/50663

Exploit https://www.vicarius.io/vsociety/posts/understanding-the-wordpress-sql-injection...

and 1 more references

/ 100

high-risk

Severity 24/34 · High

Exploitability 20/34 · Moderate

Exposure 13/34 · Low