WordPress core

CVE-2022-21661

WordPress: SQL Injection through WP_Query

Severity: High 7.5
Published: 6 Jan 2022
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3
Also known as: GHSA-6676-cqfm-gw84
Sources: NVD, WordPress

Description

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37.…

Affected software

Software Affected versions

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	From 5.8 before 5.8.3 From 5.7 before 5.7.5 From 5.6 before 5.6.7 From 5.5 before 5.5.8 All 23 release lines Every version before 5.8.3 From 3.7 before 3.7.37 From 3.8 before 3.8.37 From 3.9 before 3.9.35 From 4.0 before 4.0.34 From 4.1 before 4.1.34 From 4.2 before 4.2.31 From 4.3 before 4.3.27 From 4.4 before 4.4.26 From 4.5 before 4.5.25 From 4.6 before 4.6.22 From 4.7 before 4.7.22 From 4.8 before 4.8.18 From 4.9 before 4.9.19 From 5.0 before 5.0.15 From 5.1 before 5.1.12 From 5.2 before 5.2.14 From 5.3 before 5.3.11 From 5.4 before 5.4.9 From 5.5 before 5.5.8 From 5.6 before 5.6.7 From 5.7 before 5.7.5 From 5.8 before 5.8.3

WordPressWordPress core · cpe:a:wordpress:wordpress

From 5.8 before 5.8.3
From 5.7 before 5.7.5
From 5.6 before 5.6.7
From 5.5 before 5.5.8

All 23 release lines

Every version before 5.8.3
From 3.7 before 3.7.37
From 3.8 before 3.8.37
From 3.9 before 3.9.35
From 4.0 before 4.0.34
From 4.1 before 4.1.34
From 4.2 before 4.2.31
From 4.3 before 4.3.27
From 4.4 before 4.4.26
From 4.5 before 4.5.25
From 4.6 before 4.6.22
From 4.7 before 4.7.22
From 4.8 before 4.8.18
From 4.9 before 4.9.19
From 5.0 before 5.0.15
From 5.1 before 5.1.12
From 5.2 before 5.2.14
From 5.3 before 5.3.11
From 5.4 before 5.4.9
From 5.5 before 5.5.8
From 5.6 before 5.6.7
From 5.7 before 5.7.5
From 5.8 before 5.8.3

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21661
CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21661
GitHub Advisory Database https://github.com/advisories/GHSA-6676-cqfm-gw84
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84