TI-2022-06041 Aliases CVE-2022-21663

Authenticated Object Injection in Multisites in WordPress

HIGH 67CWE-74Published 2022-01-06 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.03816 90th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed wordpress-develop (WordPress): 5.8.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WordPress	wordpress-develop	before 5.8.3	5.8.3	Patch available	CNA

wordpress-develop VendorWordPress Affected before 5.8.3 Fixed in 5.8.3 Patch available CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:wordpress:wordpress::::::::	before 5.8.3	Vulnerable	WordPress
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions before 5.8.3 Vulnerable ·WordPress
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

Fix · CNA wordpress-develop (WordPress) Fixed in 5.8.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-01-06
wordpress-develop — FEDORA-2022-e37e1e6c7a
4 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2022-06039 SQL injection in WordPressPriority HIGH 81
- TI-2022-06040 Stored XSS in WordPressPriority HIGH 73
- TI-2022-06042 SQL injection in WordPressPriority MEDIUM 44
Show all 4 records → Advisory →
Advisory · 2022-01-06
wordpress-develop — FEDORA-2022-8472dd59ff
4 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2022-06039 SQL injection in WordPressPriority HIGH 81
- TI-2022-06040 Stored XSS in WordPressPriority HIGH 73
- TI-2022-06042 SQL injection in WordPressPriority MEDIUM 44
Show all 4 records → Advisory →

Show 1 more group

Advisory · 2022-01-06
wordpress-develop — DSA-5039
4 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2022-06039 SQL injection in WordPressPriority HIGH 81
- TI-2022-06040 Stored XSS in WordPressPriority HIGH 73
- TI-2022-06042 SQL injection in WordPressPriority MEDIUM 44
Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-21663
2026-10-30 EPSS moved to the 90th–95th percentile

References

Exploit 1

https://blog.sonarsource.com/wordpress-object-injection-vulnerability/

Advisory 6

TI-2026-45010 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution KEVCVSS 3.1CRITICAL 9.8
TI-2016-08118 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… KEVCVSS 3.1CRITICAL 9.8
TI-2026-83466 Predictable staging paths let attackers run code in WordPress Core KEVCVSS 3.1HIGH 8.1
TI-2026-59973 An unauthenticated attacker can make `get_page_template()` page-template resolution… KEVCVSS 3.1HIGH 8.1
TI-2016-08129 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass… CVSS 3.1CRITICAL 9.8
TI-2026-42844 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query KEVCVSS 3.1MEDIUM 5.9

See all 356 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences