PT-2022-24040 · WordPress · Owm Weather

Daniel Krohmer + 1 · Published 2022-11-28 · Updated 2025-04-25 · CVE-2022-3769

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OWM Weather WordPress plugin versions prior to 5.6.9

Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited by users with a role as low as contributor.

Recommendations For versions prior to 5.6.9, update to version 5.6.9 or later to resolve the issue. As a temporary workaround, consider restricting the contributor role's access to sensitive areas of the WordPress plugin until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2022-3769

Affected Products

Owm Weather

References · 8

• 🔥 https://bulletin.iese.de/post/owm-weather_5-6-8 · Exploit
• 🔥 https://wpscan.com/vulnerability/2f9ffc1e-c8a9-47bb-a76b-d043c93e63f8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3769 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3769 · Vendor Advisory
• https://t.me/cvenotify/119804 · Telegram Post
• https://t.me/cibsecurity/53568 · Telegram Post
• https://t.me/cvenotify/38951 · Telegram Post
• https://t.me/cvenotify/38575 · Telegram Post