CVE-2022-1472

Better Find and Replace < 1.3.6 - Admin+ SQLi

The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection

Affected

Better Find and Replace

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.26% chance of exploitation in the next 30 days, 69th percentile

Published

2022-06-20

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9c608b14-dc5e-469e-b97a-84696fae804c

References

• CVE Record
• NVD entry