WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection

2022-01-06 00:00
Simon Scannell

Strategic Overview

Status
Patched in 3.7.37
Affected CoreWordPress 5.8
Affected Version3.7 – < 5.8.3 · 22 branches
CVSS6.6Medium
CVECVE-2022-21663
View all WordPress 5.8 vulnerabilities

Vulnerability Overview

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Technical Analysis

REMEDIATION: Update to one of the following versions, or a newer patched version: 3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3 --- IDENTIFIER: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

External References

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C