CVE-2022-2798

The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data

CVSS v3.1

8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

1.03% chance of exploitation in the next 30 days, 61th percentile

Published

2022-09-16

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd

References

• CVE Record
• NVD entry

Related

• CVE-2022-2796
• CVE-2022-27984
• CVE-2022-27958
• CVE-2022-27985
• CVE-2022-27952
• CVE-2022-2799