CVE-2022-0814
Published: 09 May 2022
Summary
CVE-2022-0814 is a critical-severity SQL Injection (CWE-89) vulnerability in Ubigeo De Peru Para Woocommerce Project Ubigeo De Peru Para Woocommerce. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Ubigeo de Perú para Woocommerce WordPress plugin before version 3.6.4 contains a SQL injection vulnerability (CWE-89) because it fails to properly sanitize and escape parameters supplied to SQL statements across multiple AJAX actions. The flaw affects any site using the plugin and carries a CVSS 3.1 score of 9.8.
Unauthenticated attackers can invoke the vulnerable AJAX endpoints over the network to inject arbitrary SQL, enabling them to read, modify, or delete database contents and potentially achieve full site compromise without any user interaction or authentication.
WPScan advisories identify the issue in the plugin and indicate that updating to version 3.6.4 or later removes the unsanitized code paths. The associated EPSS score of 0.58 reflects sustained exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15864
Vulnerability details
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.