CVE-2022-46860CWE-89

WordPress Short URL Plugin <= 1.6.4 is vulnerable to SQL Injection

High · published November 6, 2023

CVSS v3.1
8.5
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection vulnerability lurks in KaizenCoders Short URL versions up to 1.6.4, ready to exploit your database with just a few keystrokes! ⚡ Think of it like a poorly designed restaurant menu that allows diners to add any ingredient they want to their dish — suddenly, the chef is at the mercy of the customers' whims, and nobody knows what might end up on your plate! An attacker could run wild, executing arbitrary SQL commands that might let them read sensitive data, modify records, or even wipe the entire database clean! This could lead to devastating data breaches and a loss of user trust — absolutely devastating for any business!

Put simply

Think of it like a poorly designed restaurant menu that allows diners to add any ingredient they want to their dish — suddenly, the chef is at the mercy of the customers' whims, and nobody knows what might end up on your plate! This SQL injection vulnerability allows attackers to manipulate SQL queries sent to the database through the Short URL component, potentially leading to unauthorized access and data manipulation.

What to do

An attacker could run wild, executing arbitrary SQL commands that might let them read sensitive data, modify records, or even wipe the entire database clean! This could lead to devastating data breaches and a loss of user trust — absolutely devastating for any business! Update to version 1.6.5 or later immediately! Additionally, review your database queries to ensure they are using prepared statements to prevent similar attacks in the future. Don't let this vulnerability leave your system vulnerable! You’ve got this! With a quick update and some precaution, you’ll have this vulnerability covered in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00685 · 52.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-11-06T07:53Z
EPSS history
Timeline
  • 06 NOV 07:53Z
    WordPress Short URL Plugin <= 1.6.4 is vulnerable to SQL Injection
    cvelistv5