CVE-2022-0949
WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 8.0%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
11 Apr 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
Affected products
Unknown · Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam ProtectionWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →