CVE-2022-0693

Deeper analysis

The Master Elements WordPress plugin through version 8.0 is affected by an unauthenticated SQL injection vulnerability tracked as CVE-2022-0693. The flaw stems from missing validation and escaping of the meta_ids parameter in the remove_post_meta_condition AJAX action, which is exposed to both unauthenticated and authenticated users; the parameter is inserted directly into a SQL statement, corresponding to CWE-89 and carrying a CVSS 3.1 score of 9.8.

An attacker can invoke the AJAX endpoint without authentication to supply crafted meta_ids values that alter the generated SQL query. Successful exploitation grants the ability to read, modify, or delete arbitrary database contents, potentially leading to full site compromise given the high impact on confidentiality, integrity, and availability.

The referenced WPScan advisory at the supplied URL documents the issue but does not detail an official patch or mitigation steps within the provided information. The associated EPSS score has remained steady at its peak value of 0.6823, indicating sustained exploitation interest since disclosure.