by Kastro
Paper/Archive/CVE-2022-0867

CVE-2022-0867

Unknown Pricing Table Plugin — ARPrice Lite < 3.6.1 - Unauthenticated SQLi

EPSS 13%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.4.964 × 2019.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users

Affected

ProductAffectedFixed inSource
Pricing Table Plugin3.6.1 – < 3.6.13.6.1CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494