{"id":"CVE-2022-21661","published":"2022-01-06T22:50:11Z","modified":"2024-09-09T14:13:15Z","title":"SQL injection in WordPress","vendor":"WordPress","product":"wordpress-develop","tier":"core","eol":null,"affectedVersions":[{"vendor":"WordPress","product":"wordpress-develop","versions":["< 5.8.3"]}],"description":{"text":"WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"summary":{"text":"The SQL injection flaw lives in WordPress (wordpress-develop), where improper sanitization in the WP_Query component can allow SQL injection through plugins or themes that use it in a particular way. An attacker would need network access and high privileges, and exploitation depends on a plugin or theme that uses WP_Query in the affected manner, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:32Z"},"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.97795,"percentile":0.99905,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-12-23","exploitedFirstSeen":"2023-12-23","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-23&host_type=src&vulnerability=cve-2022-21661","date":"2023-12-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-01&host_type=src&vulnerability=cve-2022-21661","date":"2024-02-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-12&host_type=src&vulnerability=cve-2022-21661","date":"2024-04-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-22&host_type=src&vulnerability=cve-2022-21661","date":"2024-08-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-18&host_type=src&vulnerability=cve-2022-21661","date":"2024-09-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-25&host_type=src&vulnerability=cve-2022-21661","date":"2024-09-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-20&host_type=src&vulnerability=cve-2022-21661","date":"2024-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-21&host_type=src&vulnerability=cve-2022-21661","date":"2024-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-03&host_type=src&vulnerability=cve-2022-21661","date":"2024-12-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-04&host_type=src&vulnerability=cve-2022-21661","date":"2024-12-04"}],"evidenceTotal":24,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"Making Fun of Your APT Malware - Bitter APT Using ZxxZ Backdoor to Target Pakistan Public Accounts Committee | Malware Hell","url":"https://otx.alienvault.com/pulse/62c41ae2730d802fbec07b10","created":"2022-07-05"},{"name":"CVE-2022-21661 : WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to","url":"https://otx.alienvault.com/pulse/62a2be738cdae9756d0909fe","created":"2022-06-10"},{"name":"A VULNERABILITY HAS BEEN FOUND IN WORDPRESS UP TO 5.8.2","url":"https://otx.alienvault.com/pulse/61d9a4c5afb34168317cbef0","created":"2022-01-08"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214","tags":["x_refsource_MISC"]},{"url":"https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/","tags":["x_refsource_MISC"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-020/","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2022/dsa-5039","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.exploit-db.com/exploits/50663","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.vicarius.io/vsociety/posts/understanding-the-wordpress-sql-injection-vulnerability-cve-2022-21661","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-26878","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26878","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":50663,"url":"https://www.exploit-db.com/exploits/50663","title":"WordPress Core 5.8.2 - 'WP_Query' SQL Injection","type":"webapps","platform":"php","date":"2022-01-13","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-01-13"},"pocGithub":{"count":11,"skipped":2,"earliest":"2022-02-12","earliestUrl":"https://github.com/purple-WL/wordpress-CVE-2022-21661","repos":[{"name":"z92g/CVE-2022-21661","url":"https://github.com/z92g/CVE-2022-21661","stars":29,"created":"2022-07-28"},{"name":"purple-WL/wordpress-CVE-2022-21661","url":"https://github.com/purple-WL/wordpress-CVE-2022-21661","stars":17,"created":"2022-02-12"},{"name":"0x4E0x650x6F/Wordpress-cve-CVE-2022-21661","url":"https://github.com/0x4E0x650x6F/Wordpress-cve-CVE-2022-21661","stars":15,"created":"2022-05-28"},{"name":"guestzz/CVE-2022-21661","url":"https://github.com/guestzz/CVE-2022-21661","stars":7,"created":"2022-07-31"},{"name":"WellingtonEspindula/SSI-CVE-2022-21661","url":"https://github.com/WellingtonEspindula/SSI-CVE-2022-21661","stars":6,"created":"2023-01-13"}]},"nuclei":[{"id":"CVE-2022-21661","name":"WordPress <5.8.3 - SQL Injection","severity":"high","path":"http/cves/2022/CVE-2022-21661.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21661.yaml"}],"first":{"date":"2022-01-13","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/50663"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/50663","http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html"],"flow":[],"timeline":[{"date":"2022-01-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-21661","provenance":"source"},{"date":"2022-01-13","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-50663); later: PoC-in-GitHub 2022-02-12","url":"https://www.exploit-db.com/exploits/50663","provenance":"source"},{"date":"2023-12-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-23&host_type=src&vulnerability=cve-2022-21661","provenance":"source"}],"speed":{"daysToPublicExploit":7,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":67.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1043 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 NVD exploit links; 11 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":5.6,"detail":"base score 8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}