CVE-2022-21661

WordPress Core < 5.8.3 - SQL Injection via WP_Query

2021-01-06 00:00
ngocnb from GiaoHangTietKiem JSC

Strategic Overview

Status
Patched in 3.7.37
Affected Core
WordPress 5.8
Affected Version
3.7 – < 5.8.3 · 22 branches
CVSS
8.0High
Weakness type
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE
CVE-2022-21661
View all WordPress 5.8 vulnerabilities

At a glance

CVE-2022-21661 is a high-severity Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the WordPress 5.8 WordPress release line, affecting 3.7 – < 5.8.3 · 22 branches. It carries a CVSS score of 8.0 (reachable over the network; high confidentiality, integrity, availability impact). The issue is fixed in version 3.7.37; sites on affected versions should update now. Disclosed January 2021, reported by ngocnb from GiaoHangTietKiem JSC.

Vulnerability Overview

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Reaching this weakness in WordPress 5.8 3.7 – < 5.8.3 · 22 branches takes a caller who can reach the endpoint. SQL injection happens when request data is concatenated into a query instead of being bound as a parameter, letting an attacker change the structure of the statement rather than just its values.

A working injection can read any table the database user can see, which on a WordPress install means user records, password hashes and session or API secrets stored in options. For WordPress 5.8 the fix is 3.7.37: builds 3.7 – < 5.8.3 · 22 branches are affected, anything from 3.7.37 onward is not.

Remediation

Update to one of the following versions, or a newer patched version: 3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3

How does WordSec protect against this?

The attempt arrives as an ordinary request to WordPress 5.8: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: updating to 3.7.37 is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2022-21661https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ef885f-fd62-4513-83cb-65381b99a172https://nvd.nist.gov/vuln/detail/CVE-2022-21661

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C