Skip to content
Sign in
9.8 Critical

CVE-2022-4357 The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL…

Description

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected products and versions

Product Affected versions Fixed in
LetsRecover 1.2 earliest → < 1.2.0 1.2.0

Other CVEs of LetsRecover

The 3 CVEs of LetsRecover →
CVE-2022-4355 The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL… 7.2 High CVE-2022-4356 The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL… 7.2 High
Track this CVE