CVE-2022-21661: WordPress Core WP_Query SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WPQuery class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Other sources
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WPQuery, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 6.1.9+dfsg1-0+deb12u1Fixed in 6.8.7+dfsg1-0+deb13u1Fixed in 6.8.12+dfsg1-0+deb13u1Fixed in 7.1.4+dfsg1-1 - Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 5.8.3+dfsg1-1 - Upgrade
Upgrade
WordPress Coreto a version that resolves this vulnerability.Fixed in 5.8.3 - Upgrade
Upgrade
WordPress Coreto a version that resolves this vulnerability.Fixed in 3.7.37 - Configuration
Keep auto-updates enabled.
WordPress Core auto-updates = enabled
Event History
Frequently Asked Questions
What is CVE-2022-21661?
CVE-2022-21661 is a SQL Injection vulnerability in WordPress Core WP_Query that allows for information disclosure.
How does CVE-2022-21661 affect WordPress?
CVE-2022-21661 affects WordPress versions up to and including 5.8.3.
What is the severity of CVE-2022-21661?
CVE-2022-21661 has a severity rating of 7.5 (High).
How can I fix CVE-2022-21661?
To fix CVE-2022-21661, update your WordPress installation to version 5.8.4 or later.
Where can I find more information about CVE-2022-21661?
You can find more information about CVE-2022-21661 on the following websites: [Packet Storm Security](http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html), [GitHub commit](https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214), [WordPress security advisories](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84).