CVE-2022-0784 Title Experiments Free < 9.0.1 - Unauthenticated SQLi

2022-03-2817:23:21

CWE-89

WPScan

www.cve.org

0.04 Low

EPSS

Percentile

92.2%

JSON

The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection

CNA Affected

[
  {
    "product": "Title Experiments Free",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "9.0.1",
        "status": "affected",
        "version": "9.0.1",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/6672b59f-14bc-4a22-9e0b-fcab4e01d97f

0.04 Low

EPSS

Percentile

92.2%

JSON

Related for CVELIST:CVE-2022-0784