Not rated

CVE-2022-0769 The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it…

Description

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.

Affected products and versions

Product	Affected versions	Fixed in
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin	3.1.0	No fix stated

Do you use Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin?

Track this CVE Watch Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2022-0769

Timeline

Published April 25, 2022
Last modified August 2, 2024

References

wpscan.com wpscan.com

Track this CVE