CVE-2022-0783
Published: 02 May 2022
Summary
CVE-2022-0783 is a critical-severity SQL Injection (CWE-89) vulnerability in Themehigh Multiple Shipping Addresses For Woocommerce. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2022-0783 affects the Multiple Shipping Address Woocommerce WordPress plugin before version 2.0. It arises from a failure to properly sanitize and escape multiple parameters before they are incorporated into SQL statements through certain AJAX actions that are reachable by unauthenticated users, producing unauthenticated SQL injection flaws (CWE-89) rated at CVSS 9.8.
Unauthenticated remote attackers can supply crafted input to these AJAX endpoints to execute arbitrary SQL commands against the underlying database, achieving full read, write, and delete access that can result in complete compromise of confidentiality, integrity, and availability.
The referenced WPScan advisory documents the issue and the affected plugin versions. The associated EPSS score stands at 0.5453.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15835
Vulnerability details
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.