Better Search and Replace < 1.4.1 - Admin+ SQLi
CVE-2022-2593

7.2HIGH

Key Information:

Vendor
Wordpress
Status
Better Search Replace
Vendor
CVE Published:
22 August 2022

Summary

The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks

Affected Version(s)

Better Search Replace 1.4.1

References

https://wpscan.com/vulnerability/229a065e-1062-44d4-818d-...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christiaan Swiers
.