Vulnerability · Published Nov 28, 2022 · Assigned by WPScan

CVE-2022-3768WPSmartContracts < 1.3.12 - Author+ SQLi

High 8.8

In plain English

A high-severity security flaw in WPSmartContracts from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)4.1%top 9.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author

Affected products (as reported)

Vendor	Product	Versions
Unknown	WPSmartContracts	0 – before 1.3.12

References

https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3 exploit, vdb-entry, technical-description
https://bulletin.iese.de/post/wp-smart-contracts_1-3-11/