VulnerabilityModified

CVE-2022-0434

As a result, unauthenticated attackers could perform SQL injection attacks

CRITICAL 9.8EPSS 14.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 14.8%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 14.78% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: a3rev/page view count
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/be895016-7365-4ce4-a54f-f36d0ef2d6f1Exploit, Third Party Advisory
https://wpscan.com/vulnerability/be895016-7365-4ce4-a54f-f36d0ef2d6f1Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.