PerfoMetrix

All vulnerabilities · WordPress

WordPress WP_Query SQL Injection (CVE-2022-21661): Check Your WordPress Version

CVE-2022-21661CVSS 7.5

A SQL injection in WP_Query affected WordPress 3.7 to 5.8.2. See which releases are fixed in every branch and how to check the version your site shows.

Is your site affected? Check the WordPress version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
>=3.7 <3.7.37
>=3.8 <3.8.37
>=3.9 <3.9.35
>=4.0 <4.0.34
>=4.1 <4.1.34
>=4.2 <4.2.31
>=4.3 <4.3.27
>=4.4 <4.4.26
>=4.5 <4.5.25
>=4.6 <4.6.22
>=4.7 <4.7.22
>=4.8 <4.8.18
>=4.9 <4.9.19
>=5.0 <5.0.15
>=5.1 <5.1.12
>=5.2 <5.2.14
>=5.3 <5.3.11
>=5.4 <5.4.9
>=5.5 <5.5.8
>=5.6 <5.6.7
>=5.7 <5.7.5
>=5.8 <5.8.3
5.8.3
5.7.5
5.6.7
5.5.8
5.4.9
5.3.11
5.2.14
5.1.12
5.0.15
4.9.19

WP_Query, the class WordPress uses to fetch posts, didn’t fully sanitize some of its input. Themes and plugins that passed user input into a query could be used for SQL injection, reading or changing database contents. WordPress fixed it in 5.8.3 in January 2022 and backported the fix to every branch back to 3.7.

Who is affected

WordPress 3.7 to 5.8.2, except the patched releases of each branch (for example 5.7.5 or 4.9.19). Sites with automatic background updates usually received the fix within days.

What our check looks at

We read the WordPress version in the page’s generator tag (WordPress 5.8.2) and compare it with the affected ranges for its branch. Many sites remove that tag; then we can’t tell.

How to fix it

  1. Update WordPress (Dashboard → Updates), ideally to the current release.
  2. Keep automatic minor updates on; they deliver security fixes like this one.
  3. Remove the version from the page. Most security plugins do this, or add remove_action('wp_head', 'wp_generator'); to your theme.

FAQ

Our site runs WordPress 5.7.5. Is it affected?

No, 5.7.5 contains the backported fix. But the 5.7 branch is long out of support; plan the update.

Does a security plugin protect us?

It can block known attack patterns, but only updating removes the flaw.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free