CVE-2022-21664 WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. There's potential for unintended SQL queries due to lack of sanitization in one of the classes

CVE-2022-21664 WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. There's potential for unintended SQL queries due to lack of sanitization in one of the classes

If you experience any issues with your installation, or if you want to check if you're running a patched version of WordPress, you can do so by visiting the Settings > General menu and checking the WordPress version. If it's below 4.1.34, then your installation is affected by this issue. WordPress version 4.1.34 and below are vulnerable to SQL Injection. WordPress version 4.2.1 and below are vulnerable to XSS Injection. WordPress version 4.3.1 and below are vulnerable to Remote Code Execution. WordPress version 4.4.1 and below are vulnerable to Credential Stuffing. In addition to the above, WordPress versions 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.5.7, 4.5.8, 4.5.9, 4.5.10, 4.5.11, 4.5.12, 4.5.13, 4.5.14, 4.5.15, 4.5.16, 4.5.17, 4.5.18, 4.5.19, 4.5.20, 4.5.21, 4.5.22, 4.5.23, 4.5.24, 4.5.25, 4.5.26, 4.5.27, 4.

How do I check if WordPress is vulnerable?

If you are curious about if your WordPress installation is affected, you can check the version number of your WordPress installation.
WordPress version 4.1.34 and below are vulnerable to SQL Injection
WordPress version 4.2.1 and below are vulnerable to XSS Injection
WordPress version 4.3.1 and below are vulnerable to Remote Code Execution
WordPress version 4.4.1 and below are vulnerable to Credential Stuffing

Installation of WordPress code

The installation page for WordPress includes a warning at the end when you're asked to download and install the code.
The warning says that the code has been tested to work on "WordPress 4.1.34+ with PHP 5.2+." If you're unsure if your installation is vulnerable, search for this phrase in your installation's source code.
If you find any occurrences of this phrase, click the "X" next to them to delete them.

SQL Injection

SQL injection occurs when input is sent to a database that then executes commands inserted by the attacker. The most common method for SQL injection is when an application passes user input to a MySQL database without encoding special characters.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe