Log in Start free

Vulnerability · Published Jan 6, 2022 · Assigned by GitHub_M

CVE-2022-21663Authenticated Object Injection in Multisites in WordPress

Medium 6.6

In plain English

A medium-severity injection in wordpress-develop from WordPress. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)3.8%top 9.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wordpress5.8.3+dfsg1-1DEBIAN-CVE-2022-21663
Debian:13wordpress5.8.3+dfsg1-1DEBIAN-CVE-2022-21663
Debian:14wordpress5.8.3+dfsg1-1DEBIAN-CVE-2022-21663

Affected products (as reported)

VendorProductVersions
WordPress wordpress-develop < 5.8.3

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References