PT-2022-15018 · WordPress · Wordpress

Khuyenn + 1 · Published 2022-01-06 · Updated 2025-08-04 · CVE-2022-21664

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.8.3 WordPress versions prior to 4.1.34

Description WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed.

Recommendations For WordPress versions prior to 5.8.3, update to version 5.8.3 or later. For WordPress versions prior to 4.1.34, update to version 4.1.34 or later. Keep auto-updates enabled to ensure the latest security patches are applied. At the moment, there is no information about additional mitigation measures for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-WORDPRESS-2022-21664

BIT-WORDPRESS-MULTISITE-2022-21664

CVE-2022-21664

DLA-2884-1

DSA-5039-1

GHSA-JP3P-GW8H-6X86

Affected Products

Wordpress

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21664.json · Exploit
• https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21664 · Vendor Advisory
• https://debian.org/security/2022/dsa-5039 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21664 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21664 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2022-21664 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2884-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5039-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21664 · Security Note
• https://osv.dev/vulnerability/BIT-wordpress-2022-21664 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21664 · Vendor Advisory