CVE-2022-4049

CRITICALNuclei

WP User <= 7.0 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-4049 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 10, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP User

Default status: affected

CVE ListThrough 7.0affected

Nuclei templates

1
ProjectDiscoveryCRITICALWP User <= 7.0 - Unauthenticated SQLiCVSS 9.8

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Impact

Unauthenticated attackers can execute time-based blind SQL injection through the id parameter in wpuser_group_action AJAX endpoint, potentially extracting sensitive database information including user credentials, personal data, and WordPress configuration.

Remediation

Update WP User plugin to a version later than 7.0 that properly sanitizes and parameterizes the id parameter in admin-ajax.php.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022sqliwpscanwordpresswp-pluginwpwp-userunauthwp_user_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wp_user_project:wp_user:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/wp-user/
FOFA: body=/wp-content/plugins/wp-user/
https://wpscan.com/vulnerability/9b0781e2-ad62-4308-bafc-d45b9a2472be https://wordpress.org/plugins/wp-user/ https://nvd.nist.gov/vuln/detail/CVE-2022-4049 https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2