CVE-2022-1800 Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection

2022-06-1312:43:04

CWE-89

WPScan

www.cve.org

wordpress

sql injection

cve-2022-1800

export

xml/csv

admin+

EPSS

0.001

Percentile

37.7%

JSON

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.

CNA Affected

[
  {
    "product": "Export any WordPress data to XML/CSV",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.3.5",
        "status": "affected",
        "version": "1.3.5",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/4267109c-0ca2-441d-889d-fb39c235f128

EPSS

0.001

Percentile

37.7%

JSON

Related for CVELIST:CVE-2022-1800