Vulnerability · Published Jul 22, 2022 · Assigned by Patchstack
CVE-2022-30998WordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities
Critical 9.1
In plain English
A critical-severity SQL injection in Homepage Product Organizer for WooCommerce (WordPress plugin) from WooPlugins.co. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.9%top 39.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WooPlugins.co | Homepage Product Organizer for WooCommerce (WordPress plugin) | <= 1.1 – through 1.1 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
References
- https://wordpress.org/plugins/homepage-product-organizer-for-woocommerce/#description x_refsource_CONFIRM
- https://patchstack.com/database/vulnerability/homepage-product-organizer-for-woocommerce/wordpress-homepage-product-organizer-for-woocommerce-plugin-1-1-multiple-authenticated-sql-injection-sqli-vulnerabilities x_refsource_CONFIRM