CVE-2022-4059

CRITICALNuclei

Cryptocurrency Widgets Pack < 2.0 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-4059 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 30, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 10, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Cryptocurrency Widgets Pack

Default status: unaffected

CVE ListBefore 2.0affected

cryptocurrency_widgets_pack

Browse blocksera / cryptocurrency_widgets_pack
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALCryptocurrency Widgets Pack < 2.0 - SQL InjectionCVSS 9.8

The plugin does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Impact

Unauthenticated attackers can execute time-based blind SQL injection through the columns[0][name] parameter in the mcwp_table AJAX action, potentially extracting sensitive database information including cryptocurrency data, user credentials, and plugin configuration.

Remediation

Fixed in version 2.0

WeaknessesCWE-89
Authorsr3Y3r53
Template tagstime-based-sqlicvecve2022wpwp-pluginwordpresswpscansqliblockseravulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:blocksera:cryptocurrency_widgets_pack:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/cryptocurrency-widgets-pack/
FOFA: body=/wp-content/plugins/cryptocurrency-widgets-pack/
https://wpscan.com/vulnerability/d94bb664-261a-4f3f-8cc3-a2db8230895d https://nvd.nist.gov/vuln/detail/CVE-2022-4059 https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2