Vulnerability · Published Mar 14, 2022 · Assigned by WPScan
CVE-2022-0254Zero Spam < 5.2.11 - Admin+ SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in WordPress Zero Spam from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.0%top 18.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | bmarshall511/wordpress_zero_spam | 5.2.13 | GHSA-pq2f-3fg3-rw99 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WordPress Zero Spam | 5.2.11 – before 5.2.11 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997 x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2660225 x_refsource_CONFIRM
- https://plugins.trac.wordpress.org/changeset/2680906 x_refsource_CONFIRM