CVE-2022-21663 Authenticated Object Injection in Multisites in WordPress
Super Admins in WordPress multisite environments can exploit object injection to bypass hardening, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21663?
CVE-2022-21663 is a medium-severity unsafe deserialization vulnerability in Debian Debian Linux, published on 6 Jan 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
Which versions are affected by CVE-2022-21663?
2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | All versions | 5.8.3 |
wordpress-multisite Bitnami | All versions | 5.8.3 |
Products include Debian Debian Linux, Fedoraproject Fedora, Wordpress Wordpress.
How do I fix CVE-2022-21663?
Upgrade wordpress to 5.8.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-21663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-21663 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-wordpress-2022-21663, BIT-wordpress-multisite-2022-21663, DEBIAN-CVE-2022-21663, GHSA-jmmq-m8p8-332h, UBUNTU-CVE-2022-21663.