« Volver al listado

CVE-2022-2593

Estado: ModificadaAlta (7.2)—

The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Deliciousbrains — Better Search Replace

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2593",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Better Search Replace",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.1",
              "lessThan": "1.4.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-22T15:15:15.600",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/229a065e-1062-44d4-818d-29aa3b6b6d41",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/229a065e-1062-44d4-818d-29aa3b6b6d41",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks"
    },
    {
      "lang": "es",
      "value": "El plugin Better Search Replace de WordPress versiones anteriores a 1.4.1, no sanea y escapa apropiadamente los datos de la tabla antes de insertarlos en una consulta SQL, lo que podría permitir a usuarios con altos privilegios llevar a cabo ataques de inyección SQL."
    }
  ],
  "lastModified": "2026-06-17T04:42:10.837",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:deliciousbrains:better_search_replace:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "312BCF6B-64CA-42B8-9114-B72962D34E05",
              "versionEndExcluding": "1.4.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}