CVE-2022-21663

WordPress is a free and open-source content management system written in
PHP and paired with a MariaDB database. On a multisite, users with Super
Admin role can bypass explicit/additional hardening under certain
conditions through object injection. This has been patched in WordPress
version 5.8.3. Older affected versions are also fixed via security release,
that go back till 3.7.37. We strongly recommend that you keep auto-updates
enabled. There are no known workarounds for this issue.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003243&gt;