CVE-2022-46849CWE-89

WordPress Coming Soon Plugin <= 1.5.9 is vulnerable to SQL Injection

High · published November 6, 2023

CVSS v3.1
7.6
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

⚡ A sneaky SQL Injection vulnerability lurks in Weblizar Coming Soon Page versions up to 1.5.9! This flaw allows attackers to manipulate database queries without breaking a sweat! 🔥 Think of it like a restaurant where the chef blindly follows a customer's order without checking for allergies — one wrong ingredient could spoil the entire meal. In this case, malicious input can wreak havoc on your database! An attacker could exploit this vulnerability to execute harmful SQL commands, potentially accessing sensitive data, altering information, or even deleting entire databases. This could lead to catastrophic data breaches and loss of trust from your users!

Put simply

Think of it like a restaurant where the chef blindly follows a customer's order without checking for allergies — one wrong ingredient could spoil the entire meal. In this case, malicious input can wreak havoc on your database! This SQL Injection vulnerability arises from improper handling of user input in the Weblizar Coming Soon Page, allowing attackers to inject malicious SQL statements into queries that the application executes.

What to do

An attacker could exploit this vulnerability to execute harmful SQL commands, potentially accessing sensitive data, altering information, or even deleting entire databases. This could lead to catastrophic data breaches and loss of trust from your users! Immediately upgrade to the fixed version of Weblizar Coming Soon Page once available, and implement prepared statements to properly sanitize user inputs. Regularly audit your code to catch similar vulnerabilities early! You've got this! Stay proactive and fix this vulnerability to keep your site safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00675 · 51.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-11-06T07:56Z
EPSS history
Timeline
  • 06 NOV 07:56Z
    WordPress Coming Soon Plugin <= 1.5.9 is vulnerable to SQL Injection
    cvelistv5