Strix
26.1K

CVE-2022-21661

HIGHCVSS 7.5/10EPSS 97.80%

Last modified

CVE-2022-21661 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. EPSS estimates a 97.80% chance of exploitation in the next 30 days.

Description

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
97.80%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
WordpressWordpress>= 3.7, < 3.7.37
WordpressWordpress>= 3.8, < 3.8.37
WordpressWordpress>= 3.9, < 3.9.35
WordpressWordpress>= 4.0, < 4.0.34
WordpressWordpress>= 4.1, < 4.1.34
WordpressWordpress>= 4.2, < 4.2.31
WordpressWordpress>= 4.3, < 4.3.27
WordpressWordpress>= 4.4, < 4.4.26
WordpressWordpress>= 4.5, < 4.5.25
WordpressWordpress>= 4.6, < 4.6.22
WordpressWordpress>= 4.7, < 4.7.22
WordpressWordpress>= 4.8, < 4.8.18
WordpressWordpress>= 4.9, < 4.9.19
WordpressWordpress>= 5.0, < 5.0.15
WordpressWordpress>= 5.1, < 5.1.12
WordpressWordpress>= 5.2, < 5.2.14
WordpressWordpress>= 5.3, < 5.3.11
WordpressWordpress>= 5.4, < 5.4.9
WordpressWordpress>= 5.5, < 5.5.8
WordpressWordpress>= 5.6, < 5.6.7
WordpressWordpress>= 5.7, < 5.7.5
WordpressWordpress>= 5.8, < 5.8.3
FedoraprojectFedora34
FedoraprojectFedora35
DebianDebian Linux9.0
DebianDebian Linux10.0
DebianDebian Linux11.0

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2022-21661?
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
How severe is CVE-2022-21661?
CVE-2022-21661 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 97.80% probability of exploitation in the next 30 days.
How do I fix CVE-2022-21661?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-21661?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST