Vulnerability · Published Jan 2, 2023 · Assigned by WPScan

CVE-2022-4049WP User <= 7.0 - Unauthenticated SQLi

Critical 9.8

In plain English

A critical-severity security flaw in WP User from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.1% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)5.1%top 7.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP User	0 – through 7.0

References

https://wpscan.com/vulnerability/9b0781e2-ad62-4308-bafc-d45b9a2472be exploit, vdb-entry, technical-description