PT-2022-15636 · WordPress · Website File Changes Monitor

Nicolas Vidal · Published 2022-08-08 · Updated 2022-08-12 · CVE-2022-2269

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Website File Changes Monitor WordPress plugin versions prior to 1.8.3

Description The issue arises from the plugin's failure to sanitise and escape user input before using it in a SQL statement. This occurs via an action available to users with the manage options capability, which by default includes admins. The lack of proper input sanitisation and escaping leads to an SQL injection.

Recommendations For versions prior to 1.8.3, update to version 1.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the action that allows user input to be used in SQL statements, or disabling the manage options capability for non-admin users until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-2269

Affected Products

Website File Changes Monitor

References · 5

• 🔥 https://wpscan.com/vulnerability/bb348c92-d7e3-4a75-98aa-dd1c463bfd65 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2269 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2269 · Vendor Advisory
• https://t.me/cibsecurity/47743 · Telegram Post
• https://t.me/cvenotify/34388 · Telegram Post