PT-2022-13437 · WordPress · Title Experiments Free

Cydave · Published 2022-03-28 · Updated 2022-04-04 · CVE-2022-0784

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Title Experiments Free WordPress plugin versions prior to 9.0.1

Description The issue concerns an unauthenticated SQL injection. It occurs because the id parameter is not properly sanitised and escaped before being used in a SQL statement via the "wpex titles" AJAX action, which is accessible to unauthenticated users.

Recommendations For versions prior to 9.0.1, update to version 9.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wpex titles" AJAX action to prevent unauthenticated users from exploiting the SQL injection vulnerability.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0784

Affected Products

Title Experiments Free

References · 4

• 🔥 https://wpscan.com/vulnerability/6672b59f-14bc-4a22-9e0b-fcab4e01d97f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0784 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0784 · Vendor Advisory
• https://t.me/cibsecurity/39664 · Telegram Post