CVE-2022-0788: WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi
Published Jun 6, 2022
·Updated
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users
Affected Software
2 affected components
Wpmet Wp Fundraising Donation And Crowdfunding Platform Wordpress<1.5.0
Wpmet Fundengine Wordpress<1.5.0
Event History
Jun 6, 2022
CVE Published
via MITRE·08:50 AM
Data Sourced
via MITRE·08:50 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-0788.
2
What is the severity of CVE-2022-0788?
CVE-2022-0788 has a severity rating of 9.8 (Critical).
3
How does the WP Fundraising Donation and Crowdfunding Platform plugin before 1.5.0 handle user input?
The WP Fundraising Donation and Crowdfunding Platform plugin before 1.5.0 does not properly sanitize and escape a parameter before using it in an SQL statement.
4
Who can exploit this vulnerability?
This vulnerability can be exploited by unauthenticated users.
5
Is there a fix available for CVE-2022-0788?
Yes, the fix for CVE-2022-0788 is to update the WP Fundraising Donation and Crowdfunding Platform plugin to version 1.5.0 or later.