CVE-2022-4049

2023-01-0222:15:15

[email protected]

web.nvd.nist.gov

cve-2022-4049

nvd

sql injection

wordpress plugin

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.054 Low

EPSS

Percentile

93.2%

JSON

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Affected configurations

Vulners

NVD

Node

wp_user_projectwp_userRange≤7.0

VendorProductVersionCPE
wp_user_projectwp_user*cpe:2.3:a:wp_user_project:wp_user:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wp_user_project	wp_user	*	cpe:2.3:a:wp_user_project:wp_user::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP User",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "7.0"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]