Critical SQL Injection Vulnerability in WordPress - CVE-2022-21664
Summary
CVE-2022-21664: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Affects wordpress across 3 version ranges.
< 3c8a81ce485f3ed16617d99d0da9c1bedac4791c
< 5.7.5+dfsg1-0+deb11u1
< c09ccfbc547d75b392dbccc1ef0b4442ccd3c957
Fixed in 5.7.5+dfsg1-0+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
WordPress is a widely-used open-source content management system (CMS) written in PHP, paired with a MariaDB database. It allows users to create and manage websites easily, offering a plethora of themes and plugins for customization. However, due to a lack of proper sanitization in one of its classes, WordPress is vulnerable to SQL injection attacks, which can lead to unauthorized database access and manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2022-21664, arises from insufficient input sanitization in a specific class within WordPress. This flaw can allow attackers to execute unintended SQL queries, potentially compromising the integrity and confidentiality of the database. The severity of this vulnerability is underscored by its CVSS score of 8.8, indicating a high risk of exploitation. Attackers could leverage this vulnerability to gain unauthorized access to sensitive data, alter database contents, or even take control of the affected WordPress site.
How To Fix
Minimum fixed version
5.7.5+dfsg1-0+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wordpressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this issue. The best course of action is to apply the recommended updates as soon as possible.
Conclusion
CVE-2022-21664 represents a serious security risk for WordPress users due to its potential for SQL injection attacks. It is imperative for users to update their installations promptly to the latest versions to safeguard their sites against exploitation. Utilizing tools like Vulert can help monitor and alert users about such vulnerabilities in real-time.
See every vulnerability recorded for wordpress →
FAQ
CVE-2022-21664 is a critical SQL injection vulnerability in WordPress that allows attackers to execute unintended SQL queries due to improper input sanitization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Affected versions of WordPress include all versions prior to 5.8.3. Security releases have been issued for versions back to 4.1.34.
While there are no workarounds, it is crucial to prioritize the update as soon as possible to mitigate the risk of exploitation.
The CVSS score for CVE-2022-21664 is 8.8, indicating a high severity level and potential for significant impact if exploited.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
