Vulnerability · Published Feb 28, 2022 · Assigned by WPScan
CVE-2022-23911AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection
High 7.2
In plain English
A high-severity SQL injection in Testimonial WordPress Plugin – AP Custom Testimonial from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS NVD)7.2High
Exploit odds (30 days)1.5%top 26.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Testimonial WordPress Plugin – AP Custom Testimonial | 1.4.6 – before 1.4.6*1.4.7 – before 1.4.7 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/77fd6749-4fb2-48fa-a191-437b442f28e9 x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2664185 x_refsource_CONFIRM