CVEvulnerability

CVE-2022-21663

7.2 HIGH Published 2022-01-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-502, CWE-74

Description

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Affected configurations

• wordpress wordpress (< 5.8.3) • debian debian linux 9.0 • debian debian linux 10.0 • debian debian linux 11.0 • fedoraproject fedora 34 • fedoraproject fedora 35

Related

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References