CVE-2022-3254

AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi

The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection

Affected

WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.52% chance of exploitation in the next 30 days, 93rd percentile

Nuclei

critical

Published

2022-10-31

Updated

2025-05-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3254.yaml

References

• CVE Record
• NVD entry