PT-2022-23351 · WordPress · Contest Gallery

Minhtuanact + 1 · Published 2022-08-23 · Updated 2022-08-25 · CVE-2022-36394

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contest Gallery plugin versions <= 17.0.4

Description The issue is an authenticated SQL Injection vulnerability, affecting the Contest Gallery plugin at WordPress. This allows for SQL injection attacks when an attacker has author or higher privileges.

Recommendations For versions <= 17.0.4, update to a version higher than 17.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's database interactions until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-36394

Affected Products

Contest Gallery

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-36394 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36394 · Vendor Advisory
• https://t.me/cibsecurity/48609 · Telegram Post
• https://wordpress.org/plugins/contest-gallery/#developers · Note
• https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-17-0-4-authenticated-sql-injection-sqli-vulnerability · Note