CVE-2022-3395CWE-89

WP All Export Pro < 1.7.9 - Authenticated SQLi

High · published October 25, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL statements, leading to a SQL Injection vulnerability. By default only users with the Administrator role can perform exports, but this can be delegated to lower privileged users as well.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01246 · 69.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-10-25T00:00Z
EPSS history
Timeline
  • 25 OCT 00:00Z
    WP All Export Pro < 1.7.9 - Authenticated SQLi
    cvelistv5