CVE-2022-0949

CRITICAL NUCLEI

Block Bad Bots WordPress plugin < 6.930 - Unauthenticated SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-0949 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection

Nuclei Templates (1)

WordPress Stop Bad Bots <6.930 - SQL Injection
CRITICALVERIFIEDby theamanrawat

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/a0fbb79a-e160-49df-9cf2-18ab64ea66cb

Scores

CVSS v3 9.8
EPSS 0.0796
EPSS Percentile 94.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
stopbadbots/block_and_stop_bad_bots < 6.930
Published Apr 11, 2022
Tracked Since Feb 18, 2026