CVE-2022-0169
Published: 14 March 2022
Summary
CVE-2022-0169 is a critical-severity SQL Injection (CWE-89) vulnerability in 10Web Photo Gallery. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is an unauthenticated SQL injection flaw (CWE-89) in the Photo Gallery by 10Web WordPress plugin prior to version 1.6.0. The plugin fails to validate or escape the bwg_tag_id_bwg_thumbnails_0 parameter before incorporating it into a SQL statement executed through the bwg_frontend_data AJAX action, which is reachable by both unauthenticated and authenticated users. The issue carries a CVSS 3.1 score of 9.8.
An attacker can send a crafted request to the AJAX endpoint without authentication and inject arbitrary SQL, enabling full read/write access to the database and potential compromise of the WordPress site contents and credentials. Successful exploitation can result in confidentiality, integrity, and availability impacts rated high.
The referenced WordPress plugin changeset 2672822 and WPScan advisory document the fix that was applied in version 1.6.0; administrators should update the plugin to that release or later to eliminate the vulnerable code path. The associated EPSS score stands at 0.8216 with no indicated rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15377
Vulnerability details
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL…
more
injection
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.