CVE-2022-3768

HIGHNuclei

WPSmartContracts < 1.3.12 - Author+ SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-3768 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 25, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WPSmartContracts

Default status: unaffected

CVE ListBefore 1.3.12affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress WPSmartContracts <1.3.12 - SQL InjectionCVSS 8.8

WordPress WPSmartContracts plugin before 1.3.12 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker with a role as low as author can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

Impact

An attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Fixed in version 1.3.12

WeaknessesCWE-89
AuthorsHardik-Solanki
Template tagstime-based-sqlicvecve2022wp-smart-contractswpscanwp-pluginsqliwordpresswpauthenticatedwpsmartcontractsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wpsmartcontracts:wpsmartcontracts:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3768 https://cve.report/CVE-2022-3768 https://bulletin.iese.de/post/wp-smart-contracts_1-3-11/ https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3