CVE-2022-0773
Published: 02 May 2022
Summary
CVE-2022-0773 is a critical-severity SQL Injection (CWE-89) vulnerability in Documentor Project Documentor. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Documentor WordPress plugin through version 1.5.3 contains an SQL injection vulnerability (CWE-89) because it does not sanitize or escape user-supplied input before interpolating it into SQL statements. The flaw affects any deployment running an unpatched instance of this plugin and carries a CVSS 3.1 base score of 9.8.
Unauthenticated remote attackers can supply crafted input that is executed directly by the database, enabling them to read, modify, or delete arbitrary data and potentially take full control of the affected WordPress site.
The referenced WPScan advisory documents the issue but does not detail specific patch releases or configuration work-arounds beyond the general recommendation to update the plugin. The associated EPSS score has remained stable at its peak value of 0.7553 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15828
Vulnerability details
The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.