CVE-2022-21663: debian debian_linux Deserialization of Untrusted Data
Vulnerability summary
CVE-2022-21663 is a high (CVSS 7.2) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 3.69% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 06-01-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA6.6MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource6.6MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
3.69%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.sonarsource.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected systems
Wordpress3 products
- wordpress≥ 3.7, < 3.7.37 | ≥ 3.8, < 3.8.37 (fixed in 3.7.37) | ≥ 3.9, < 3.9.35 (fixed in 3.7.37) | ≥ 4.0, < 4.0.34 (fixed in 3.7.37) | ≥ 4.1, < 4.1.34 (fixed in 3.7.37) | ≥ 4.2, < 4.2.31 (fixed in 3.7.37) | ≥ 4.3, < 4.3.27 (fixed in 3.7.37) | ≥ 4.4, < 4.4.26 (fixed in 3.7.37) | ≥ 4.5, < 4.5.25 (fixed in 3.7.37) | ≥ 4.6, < 4.6.22 (fixed in 3.7.37) | ≥ 4.7, < 4.7.22 (fixed in 3.7.37) | ≥ 4.8, < 4.8.18 (fixed in 3.7.37) | ≥ 4.9, < 4.9.19 (fixed in 3.7.37) | ≥ 5.0, < 5.0.15 (fixed in 3.7.37) | ≥ 5.1, < 5.1.12 (fixed in 3.7.37) | ≥ 5.2, < 5.2.14 (fixed in 3.7.37) | ≥ 5.3, < 5.3.11 (fixed in 3.7.37) | ≥ 5.4, < 5.4.9 (fixed in 3.7.37) | ≥ 5.5, < 5.5.8 (fixed in 3.7.37) | ≥ 5.6, < 5.6.7 (fixed in 3.7.37) | ≥ 5.7, < 5.7.5 (fixed in 3.7.37) | ≥ 5.8, < 5.8.3 (fixed in 3.7.37)
- wordpress< 5.8.3
- wordpress-develop< 5.8.3
Debian2 products
- wordpress< 5.8.3+dfsg1-1
- debian_linuxEOL9.0 | 10.0 | 11.0
Fedoraproject1 product
- fedoraEOL34 | 35
Ubuntu1 product
- wordpressAll versions (No fix recorded)
4 vendors · 7 products
References
12 links- wordpress.org/news/2022/01/wordpress-5-8-3-security-release/X Refsource MISCREPORTRelease NotesVendor Advisory
- github.com/WordPress/wordpress-develop/security/advisories/GHSA-jmmq-m8p8-332hX Refsource CONFIRMREPORTThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/01/msg00019.htmlMailing ListX Refsource MLISTThird Party Advisory
- blog.sonarsource.com/wordpress-object-injection-vulnerability/X Refsource MISCExploitThird Party Advisory