CVE-2022-1800

Description

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.

Related CPE's

aexport_any_wordpress_data_to_xml\/csv_projectexport_any_wordpress_data_to_xml\/csv*****wordpress**

References

https://wpscan.com/vulnerability/4267109c-0ca2-441d-889d-fb39c235f128

ExploitThird Party Advisory

CvssV3 impact

Could not find any metrics

CvssV2 impact

AccessComplexity

LOW

ConfidentialityImpact

PARTIAL

AvailabilityImpact

PARTIAL

IntegrityImpact

PARTIAL

BaseScore

6.5

VectorString

AV:N/AC:L/Au:S/C:P/I:P/A:P

Version

2.0

AccessVector

NETWORK

Authentication

SINGLE

Created by Yello
About Severity.io