CVE-2022-21661: WordPress WP_Query improper sanitization enables SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityHigh CVSS (7.5), very high EPSS, and public exploit code make this a realistic target despite no KEV listing.

What it is

WordPress core fails to properly sanitize input in WP_Query, allowing SQL injection when plugins or themes pass attacker-controlled data into that class. The flaw is patched in WordPress 5.8.3, with backports to 3.7.37 and later branches. Because WP_Query is widely used by plugins and themes, exposure depends on how each site's extensions call it.

Impact

An unauthenticated attacker can inject SQL through a vulnerable WP_Query call, potentially reading sensitive database contents such as user credentials and configuration data. The CVSS vector rates confidentiality impact as high with no integrity or availability impact.

Attack surface

Reached over the network via HTTP requests to a site whose plugin or theme passes unsanitized input into WP_Query; the CVSS vector indicates no authentication and no user interaction are required. The description does not name specific vulnerable plugins or themes.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at roughly 0.978 (99.9th percentile) and public exploit references exist on Exploit-DB and Packet Storm, indicating mature, widely available exploit code.

What to do

• Update WordPress core to 5.8.3 or later, or to the relevant security release (3.7.37 and later branches).
• Keep automatic core updates enabled as the vendor recommends.
• Inventory installed plugins and themes and update or remove any that pass user input into WP_Query without sanitization.
• Apply the Debian or Fedora package updates if running WordPress from those distributions.
• Note that the vendor states there are no known workarounds, so patching is the only reliable fix.

Detection

• Review web server and WAF logs for SQL metacharacters (quotes, UNION, SLEEP, comments) in query parameters hitting WordPress endpoints.
• Enable and monitor database query logging for anomalous or malformed SQL originating from the web application.
• Check installed plugin and theme versions against vendor advisories for WP_Query usage.
• Alert on unexpected outbound or database access patterns consistent with data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.