CVE-2022-0867
ARPrice Lite < 3.6.1 - Unauthenticated SQLi
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 11.3%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
16 May 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users
Affected products
Unknown · Pricing Table PluginWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →