Cyber Resilience

CVE-2022-0773

CriticalPublic PoC

Published: 02 May 2022

Published
02 May 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.7553 98.9th percentile
Risk Priority 65 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-0773 is a critical-severity SQL Injection (CWE-89) vulnerability in Documentor Project Documentor. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The Documentor WordPress plugin through version 1.5.3 contains an SQL injection vulnerability (CWE-89) because it does not sanitize or escape user-supplied input before interpolating it into SQL statements. The flaw affects any deployment running an unpatched instance of this plugin and carries a CVSS 3.1 base score of 9.8.

Unauthenticated remote attackers can supply crafted input that is executed directly by the database, enabling them to read, modify, or delete arbitrary data and potentially take full control of the affected WordPress site.

The referenced WPScan advisory documents the issue but does not detail specific patch releases or configuration work-arounds beyond the general recommendation to update the plugin. The associated EPSS score has remained stable at its peak value of 0.7553 with no material upward trajectory after disclosure.

EU & UK References

Vulnerability details

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

documentor project
documentor
≤ 1.5.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References