PT-2022-13593 · WordPress · Wp Contacts Manager

Cydave · Published 2022-05-23 · Updated 2022-10-29 · CVE-2022-1014

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Contacts Manager WordPress plugin versions 2.2.4 and earlier

Description The issue arises from the plugin's failure to properly sanitize user-supplied POST data before it is interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.

Recommendations For WP Contacts Manager WordPress plugin versions 2.2.4 and earlier, update to a version later than 2.2.4 to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-1014

Affected Products

Wp Contacts Manager

References · 6

• 🔥 https://wpscan.com/vulnerability/eb9e202d-04aa-4343-86a2-4aa2edaa7f6b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1014 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1014 · Vendor Advisory
• https://t.me/cibsecurity/43149 · Telegram Post
• https://t.me/cvenotify/30882 · Telegram Post
• https://t.me/cvenotify/30564 · Telegram Post