CVE-2022-1950

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.51% chance of exploitation in the next 30 days, 92th percentile

Nuclei

critical · CWE-89

Published

2022-08-01

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4352283f-dd43-4827-b417-0c55d0f4637d

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1950.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-1950.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-1947
• CVE-2022-1951
• CVE-2022-1946
• CVE-2022-1952
• CVE-2022-1945
• CVE-2022-1953