Paper/Archive/CVE-2022-46818

CVE-2022-46818

Gopi Ramasamy Email posts to subscribers — WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 51.2.512 × 2010.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection.This issue affects Email posts to subscribers: from n/a through 6.2.

Affected

ProductAffectedFixed inSource

Email posts to subscribersn/a – 6.2–CNA

email_posts_to_subscribers≤ 6.2–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patchstack (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpatchstack.com/database/vulnerability/email-posts-to-subscribers/wordpress-email-posts-to-subscribers-plugin-6-2-sql-injection?_s_id=cve