CVE-2022-4447

CRITICALNuclei

Fontsy <= 1.8.6 - Multiple Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-4447 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 8, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Fontsy

Default status: affected

CVE ListThrough 1.8.6affected

fontsy

Browse fontsy_project / fontsy
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Fontsy <=1.8.6 - SQL InjectionCVSS 9.8

WordPress Fontsy plugin through 1.8.6 is susceptible to SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site.

Remediation

Update the Fontsy plugin to the latest version (>=1.8.7) or apply the vendor-provided patch to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagscvecve2022wordpresswpwpscanwp-pluginsqlifontsyunauthfontsy_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:fontsy_project:fontsy:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6939c405-ac62-4144-bd86-944d7b89d0ad https://wordpress.org/plugins/fontsy/ https://nvd.nist.gov/vuln/detail/CVE-2022-4447 https://github.com/ARPSyndicate/kenzer-templates https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2