CVE-2022-4681

2023-02-0620:15:11

[email protected]

web.nvd.nist.gov

cve-2022-4681

hide my wp

wordpress

plugin

sql injection

unauthenticated users

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.2%

JSON

The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected configurations

Vulners

NVD

Node

wpwavehide_my_wpRange<6.2.9

VendorProductVersionCPE
wpwavehide_my_wp*cpe:2.3:a:wpwave:hide_my_wp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wpwave	hide_my_wp	*	cpe:2.3:a:wpwave:hide_my_wp::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Hide My WP",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "6.2.9"
      }
    ],
    "defaultStatus": "unaffected"
  }
]