critical9.8Public exploit code
CVE-2022-4681
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Hide My WP < 6.2.9 - Unauthenticated SQLi2024-03-10 · webapps · php
Impact
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wpwave | Hide My Wp | before 6.2.9 |