CVE-2022-0867 - ARPrice Lite < 3.6.1 - Unauthenticated SQLi

Back Back to CVE browser

CRITICAL

ARPrice Lite < 3.6.1 - Unauthenticated SQLi

Published May 16, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 13.45%

Description

The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users

Affected products

Vendor n/a Product Pricing Table Plugin Default
n/a
- Version
  3.6.1
  Status
  affected
  Constraints
  <3.6.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Pricing Table Plugin

n/a

Version	Status	Constraints
3.6.1	affected	<3.6.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (1)

https://wpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published May 16, 2022

Updated Aug 2, 2024

Reserved Mar 4, 2022

Link CVE-2022-0867

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-0867

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-0867