CVE-2022-21661
Status: AnalyzedHigh (7.5)—💥 Exploit
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Base score: 7.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 98%
- Percentile among all scored CVEs: 100
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
💥 Public exploits
Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.
- Published on Exploit-DB · WordPress Core 5.8.2 - 'WP_Query' SQL Injection (1/13/2022)
- Nuclei template (automated mass detection) · WordPress <5.8.3 - SQL Injection
- Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub
⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.
Affected technologies (3)
CWEs
- CWE-89
- CWE-89
References
- http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html
- https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84
- https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
- https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/
- https://www.debian.org/security/2022/dsa-5039
- https://www.exploit-db.com/exploits/50663
- https://www.zerodayinitiative.com/advisories/ZDI-22-020/
- http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html
- https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84
- https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
- https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/
- https://www.debian.org/security/2022/dsa-5039
- https://www.exploit-db.com/exploits/50663
- https://www.vicarius.io/vsociety/posts/understanding-the-wordpress-sql-injection-vulnerability-cve-2022-21661
- https://www.zerodayinitiative.com/advisories/ZDI-22-020/
Raw JSON (NVD)
Show
{
"id": "CVE-2022-21661",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-21661",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-09T14:12:39.836888Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 1.3
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "WordPress",
"product": "wordpress-develop",
"versions": [
{
"status": "affected",
"version": "< 5.8.3"
}
]
}
]
}
],
"published": "2022-01-06T23:15:07.933",
"references": [
{
"url": "http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://www.debian.org/security/2022/dsa-5039",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://www.exploit-db.com/exploits/50663",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "security-advisories@github.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-020/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security-advisories@github.com"
},
{
"url": "http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2022/dsa-5039",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/50663",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.vicarius.io/vsociety/posts/understanding-the-wordpress-sql-injection-vulnerability-cve-2022-21661",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-020/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability."
},
{
"lang": "es",
"value": "WordPress es un sistema de administración de contenidos gratuito y de código abierto escrito en PHP y emparejado con una base de datos MariaDB. Debido a un saneo inapropiado en WP_Query, puede haber casos en los que la inyección SQL es posible mediante plugins o temas que lo usan de una manera determinada. Esto ha sido parcheado en WordPress versión 5.8.3. Las versiones más antiguas afectadas también han sido corregidas por medio de un security release, que remonta hasta la versión 3.7.37. Le recomendamos encarecidamente que mantenga habilitadas las actualizaciones automáticas. No se presentan medidas de mitigación conocidas para esta vulnerabilidad."
}
],
"lastModified": "2026-06-17T04:26:42.513",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EAB58E59-7120-448E-88C9-FD13D1470360",
"versionEndExcluding": "3.7.37",
"versionStartIncluding": "3.7"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B2CE8B3-62E6-486D-8D9F-26EB32B30BB8",
"versionEndExcluding": "3.8.37",
"versionStartIncluding": "3.8"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78C611CA-AC9B-4D6E-8CF4-A843E9361C40",
"versionEndExcluding": "3.9.35",
"versionStartIncluding": "3.9"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4874DA41-6337-4BC8-80A7-AB7908675C1F",
"versionEndExcluding": "4.0.34",
"versionStartIncluding": "4.0"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "835EDE94-98FF-4050-A8E4-B84E40B076DB",
"versionEndExcluding": "4.1.34",
"versionStartIncluding": "4.1"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90012040-14D1-4182-8975-8476544AB0B6",
"versionEndExcluding": "4.2.31",
"versionStartIncluding": "4.2"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31454589-E626-4CB7-8F73-6A8CBD05CF49",
"versionEndExcluding": "4.3.27",
"versionStartIncluding": "4.3"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB0AEE06-DE08-4210-9BC0-3C330208ECAA",
"versionEndExcluding": "4.4.26",
"versionStartIncluding": "4.4"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99162FA9-D13E-46E6-8B05-BA829E074E00",
"versionEndExcluding": "4.5.25",
"versionStartIncluding": "4.5"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7D8DE53-8A0A-46EC-90B7-839281CA1D99",
"versionEndExcluding": "4.6.22",
"versionStartIncluding": "4.6"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B120102E-B528-4B73-8CA2-5DEB0733FB27",
"versionEndExcluding": "4.7.22",
"versionStartIncluding": "4.7"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC3D088C-F073-412A-A477-F5DF27E4242E",
"versionEndExcluding": "4.8.18",
"versionStartIncluding": "4.8"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBD9028D-0E7D-46A3-8DC6-F931336AB712",
"versionEndExcluding": "4.9.19",
"versionStartIncluding": "4.9"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61D939E4-C19F-4DFE-837F-2924986BB7EB",
"versionEndExcluding": "5.0.15",
"versionStartIncluding": "5.0"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4ED53F25-4C47-43DB-99E4-EA370669C160",
"versionEndExcluding": "5.1.12",
"versionStartIncluding": "5.1"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D33A284-5838-4760-8646-9ED47B77E908",
"versionEndExcluding": "5.2.14",
"versionStartIncluding": "5.2"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82BCBE33-3D79-49D2-8484-807A698C6D90",
"versionEndExcluding": "5.3.11",
"versionStartIncluding": "5.3"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16402475-6207-4843-A37C-2029E12BBE2A",
"versionEndExcluding": "5.4.9",
"versionStartIncluding": "5.4"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62BA1541-1BAB-4402-A96F-18CC71CECD35",
"versionEndExcluding": "5.5.8",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "919E29E8-7B6A-45AC-A0D3-C78F9F7D0ECD",
"versionEndExcluding": "5.6.7",
"versionStartIncluding": "5.6"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56482037-5224-40FF-BF8B-9C52F40C03DB",
"versionEndExcluding": "5.7.5",
"versionStartIncluding": "5.7"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FE4C79C-1766-4F17-AF17-D5BD13BD1044",
"versionEndExcluding": "5.8.3",
"versionStartIncluding": "5.8"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}