What the vulnerability does
01Description
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
WordPress versions before 5.8.3 contain a SQL injection vulnerability in the database query handling. An attacker with high-level site privileges can craft malicious input to execute arbitrary SQL commands, potentially reading, modifying, or deleting database contents. The vulnerability requires network access and high administrative privileges to exploit.
What an attacker can do
03Attacker Capabilities
Execute arbitrary SQL commands to read, modify, or delete database contents.
Potential impact on your site
04Site Impact
A compromised admin account could be used to extract sensitive data, alter site content, or corrupt the database.
Conditions required to exploit
05Prerequisites
Attacker must have high-level site privileges (administrator or equivalent role).
Key dates
06Disclosure timeline
January 6, 2022
CVE published
September 9, 2024
Record updated
