CVE-2022-21664

Name	CVE-2022-21664
Description	WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2884-1, DSA-5039-1
Debian Bugs	1003243

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wordpress (PTS)	bullseye (security), bullseye	5.7.11+dfsg1-0+deb11u1	fixed
	bookworm, bookworm (security)	6.1.6+dfsg1-0+deb12u1	fixed
	sid, trixie	6.6.1+dfsg1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
wordpress	source	stretch	4.7.22+dfsg-0+deb9u1	DLA-2884-1
wordpress	source	buster	5.0.15+dfsg1-0+deb10u1	DSA-5039-1
wordpress	source	bullseye	5.7.5+dfsg1-0+deb11u1	DSA-5039-1
wordpress	source	(unstable)	5.8.3+dfsg1-1		1003243

Notes

https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jp3p-gw8h-6x86
https://github.com/WordPress/wordpress-develop/commit/c09ccfbc547d75b392dbccc1ef0b4442ccd3c957