by Kastro
Paper/Archive/CVE-2022-0814

CVE-2022-0814

Unknown Ubigeo de Perú para Woocommerce y WordPress — Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi

EPSS 8%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.8.948 × 2019.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections

Affected

ProductAffectedFixed inSource
Ubigeo de Perú para Woocommerce y WordPress3.6.4 – < 3.6.43.6.4CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/fd84dc08-0079-4fcf-81c3-a61d652e3269