Vulnerability · Published Oct 31, 2022 · Assigned by WPScan
CVE-2022-3254AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi
Critical 9.8
In plain English
A critical-severity SQL injection in WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds | 4.3 – before 4.3 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H