Lucene search
HistoryNov 28, 2022 - 2:15 p.m.
CVE-2022-3849
sql injection
wordpress
cve-2022-3849
user merger
security vulnerability
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
45.2%
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
Affected configurations
Node
wp_user_merger_projectwp_user_mergerRange<1.5.3wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| wp_user_merger_project | wp_user_merger | * | cpe:2.3:a:wp_user_merger_project:wp_user_merger:*:*:*:*:*:wordpress:*:* |
Related
cvelist
cvelist
CVE-2022-3849 WP User Merger < 1.5.3 - Admin+ SQLi via user_id
2022-11-28 13:47:16
patchstack
patchstack
prion
prion
Sql injection
2022-11-28 14:15:00
cve
cve
CVE-2022-3849
2022-11-28 14:15:17
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
45.2%
Related for NVD:CVE-2022-3849