CVE-2022-0769: vulnerability in Users Ultra Membership, Users Community and…
Users Ultra <= 3.1.0 - Unauthenticated SQL Injection
Published · Updated
Follow this CVE+ Monitor Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 8.3%
from disclosure to weapon
Published on NVDApr 25
VulnCheck+584d
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.