The WordPress development team has pushed out a software security patch that fixes four (4) vulnerabilities, with three (3) of them being deemed critical. The three (3) critical vulnerabilities are CVE-2022-21661, CVE-2022-21662, and CVE-2022-21664. Respectively, they are a critical SQL injection flaw via “WP_Query”, a cross site scripting (XSS) vulnerability that allows low-privileged users to backdoor into vulnerable sites, and another SQL injection flaw via the “WP_Meta_Query” class. At this time, there is no evidence that these vulnerabilities have been exploited in-the-wild; however, if they were, the flaws could allow an attacker to completely takeover a vulnerable WordPress website. Even if it was exploited, this flaw is not likely to affect many users due to them leaving the default automatic updates on. If users have reconfigured to manually update, then they could be susceptible to attack. The Ankura CTIX recommends all WordPress administrators ensure they are running the latest stable version (5.8.3) and have reconfigured their settings to update automatically.