WordPress core
CVE-2022-21664
WordPress: SQL injection due to improper sanitization in WP_Meta_Query
- Severity
- High 8.8
- Published
- 6 Jan 2022
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Fixed in
- 5.8.3
- Also known as
- GHSA-jp3p-gw8h-6x86
- Sources
- NVD, WordPress
Description
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that…
Affected software
| Software | Affected versions |
|---|---|
WordPressWordPress core · cpe:a:wordpress:wordpress |
|
References
- NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21664
- CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21664
- GitHub Advisory Database https://github.com/advisories/GHSA-jp3p-gw8h-6x86
- WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jp3p-gw8h-6x86