CVE-2022-46818CWE-89

WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection

High · published November 3, 2023

CVSS v3.1
8.2
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection vulnerability lies in the Email posts to subscribers feature, potentially affecting versions up to 6.2! 🔥 Think of it like a restaurant accepting custom orders without checking the ingredients — a clever hacker could slip in a dangerous request, leading to a kitchen disaster! An attacker could exploit this SQL injection flaw to gain unauthorized access to sensitive information, manipulate database records, or even delete data entirely. The consequences could be absolutely devastating for your user data and trust!

Put simply

Think of it like a restaurant accepting custom orders without checking the ingredients — a clever hacker could slip in a dangerous request, leading to a kitchen disaster! This vulnerability allows attackers to inject malicious SQL commands through improperly sanitized input in the Email posts to subscribers feature, leading to unauthorized database actions.

What to do

An attacker could exploit this SQL injection flaw to gain unauthorized access to sensitive information, manipulate database records, or even delete data entirely. The consequences could be absolutely devastating for your user data and trust! To protect yourself, update to the latest version of the affected component immediately. Also, ensure you’re implementing proper input validation and prepared statements to safeguard against SQL injection risks. You've got this! Follow these steps, and you'll have your defenses strengthened in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00652 · 50.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-11-03T15:58Z
EPSS history
Timeline
  • 03 NOV 15:58Z
    WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection
    cvelistv5