CVE-2022-21661
- Source
- https://cve.org/CVERecord?id=CVE-2022-21661
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21661.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-21661
- Aliases
-
- BIT-wordpress-2022-21661
- BIT-wordpress-multisite-2022-21661
- GHSA-6676-cqfm-gw84
- Downstream
- Published
- 2022-01-06T22:50:11Z
- Modified
- 2026-10-28T02:30:21Z
- Severity
-
- 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- SQL injection in WordPress
- Details
-
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-89" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21661.json" }- References
-
- http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html
- https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/
- https://www.exploit-db.com/exploits/50663
- https://www.vicarius.io/vsociety/posts/understanding-the-wordpress-sql-injection-vulnerability-cve-2022-21661
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21661.json
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
- https://nvd.nist.gov/vuln/detail/CVE-2022-21661
- https://www.debian.org/security/2022/dsa-5039
- https://www.zerodayinitiative.com/advisories/ZDI-22-020/
- https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214
- https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html
Affected packages
Git / github.com/wordpress/wordpress
Affected ranges
- Type
- GIT
- Repo
- https://github.com/wordpress/wordpress
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.7" }, { "fixed": "3.7.37" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.8" }, { "fixed": "3.8.37" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.9" }, { "fixed": "3.9.35" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.0" }, { "fixed": "4.0.34" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.1" }, { "fixed": "4.1.34" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2" }, { "fixed": "4.2.31" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.3" }, { "fixed": "4.3.27" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.4" }, { "fixed": "4.4.26" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.5" }, { "fixed": "4.5.25" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.6" }, { "fixed": "4.6.22" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.7" }, { "fixed": "4.7.22" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.8" }, { "fixed": "4.8.18" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.9" }, { "fixed": "4.9.19" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.0" }, { "fixed": "5.0.15" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.1" }, { "fixed": "5.1.12" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.2" }, { "fixed": "5.2.14" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.3" }, { "fixed": "5.3.11" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.4" }, { "fixed": "5.4.9" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.5" }, { "fixed": "5.5.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.6" }, { "fixed": "5.6.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.7" }, { "fixed": "5.7.5" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.8" }, { "fixed": "5.8.3" } ], "source": "CPE_RANGE" } ] }
- Type
- GIT
- Repo
- https://github.com/wordpress/wordpress-develop
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.7" }, { "fixed": "3.7.37" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.8" }, { "fixed": "3.8.37" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.9" }, { "fixed": "3.9.35" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.0" }, { "fixed": "4.0.34" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.1" }, { "fixed": "4.1.34" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2" }, { "fixed": "4.2.31" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.3" }, { "fixed": "4.3.27" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.4" }, { "fixed": "4.4.26" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.5" }, { "fixed": "4.5.25" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.6" }, { "fixed": "4.6.22" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.7" }, { "fixed": "4.7.22" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.8" }, { "fixed": "4.8.18" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.9" }, { "fixed": "4.9.19" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.0" }, { "fixed": "5.0.15" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.1" }, { "fixed": "5.1.12" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.2" }, { "fixed": "5.2.14" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.3" }, { "fixed": "5.3.11" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.4" }, { "fixed": "5.4.9" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.5" }, { "fixed": "5.5.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.6" }, { "fixed": "5.6.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.7" }, { "fixed": "5.7.5" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.8" }, { "fixed": "5.8.3" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "17efac8c8ec64555eff5cf51a3eff81e06317214" } ], "source": "REFERENCES_COMMIT" } ] }