CVE-2022-21661

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-21661
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21661.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-21661
Aliases
Downstream
Published
2022-01-06T22:50:11Z
Modified
2025-10-21T19:33:48Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
SQL injection in WordPress
Details

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.

Database specific
{
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / github.com/wordpress/wordpress

Affected ranges

Type
GIT
Repo
https://github.com/wordpress/wordpress
Events

Git / github.com/wordpress/wordpress

Affected ranges

Type
GIT
Repo
https://github.com/wordpress/wordpress-develop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed